Resource exhaustion in Matrix-Media-Repo Project
CVE-2021-29453
matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properly handle malicious images which are crafted to be small in file size, but large in complexity. A malicious user could upload a relatively small image in terms of file size, using particular image formats, which expands to have extremely large dimensions during the process of thumbnailing. The server can be exhausted of memory in the process of trying to load the whole image into memory for thumbnailing, leading to denial of service. Version 1.2.7 has a fix for the vulnerability.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.010 (61.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 61st percentile — 61.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Matrix-Media-Repo Project
- Turt2live Matrix-Media-Repo — versions <= 1.2.6
Weakness classification (CWE)
References
- github.com/turt2live/matrix-media-repo/security/advisories/GHSA-j889-h476-hh9h (Patch, Third Party Advisory)
- hub.docker.com/r/turt2live/matrix-media-repo/tags (Third Party Advisory)
- github.com/turt2live/matrix-media-repo/releases/tag/v1.2.7 (Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2021-29453?
- CVE-2021-29453 is a medium-severity vulnerability in Matrix-Media-Repo Project, classified under Uncontrolled Resource Consumption. CVSS score: 5.7/10. Published 2021-04-19.
- How severe is CVE-2021-29453?
- Medium severity. CVSS v3 base score is 5.7 out of 10.