Resource exhaustion in Matrix-Media-Repo Project
CVE-2021-29453
matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properly handle malicious images which are crafted to be small in file size, but large in complexity. A malicious user could upload a relatively small image in terms of file size, using particular image formats, which expands to have extremely large dimensions during the process of thumbnailing. The server can be exhausted of memory in the process of trying to load the whole image into memory for thumbnailing, leading to denial of service. Version 1.2.7 has a fix for the vulnerability.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.010 (59.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H.
Affected products
- Matrix-media-repo_project Matrix-media-repo
- Turt2live Matrix-media-repo — versions <= 1.2.6
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2021-29453?
- CVE-2021-29453 is a medium-severity vulnerability in Matrix-Media-Repo Project, classified under Uncontrolled Resource Consumption. CVSS score: 5.7/10. Published 2021-04-19.
- How severe is CVE-2021-29453?
- Medium severity. CVSS v3 base score is 5.7 out of 10.