Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds.
CVE-2021-21392
Published Date: 2021-04-12T22:15Z
Last Modified: 2023-11-07T03:30Z
CVSS Score: 6.3 (MEDIUM)
EPSS Score: 0.09%
Risk Score: 4.41 (MEDIUM)
Risk Score based on CVSS score and EPSS. This score is for reference purposes and is not internationally recognized.
CVSS:
6.3 |
EPSS:
0.09%
Mitre ATT&CK Technical v15.1
T1590.005 – IP Addresses
T1583.001 – Domains
T1583.004 – Server
T1059.006 – Python
T1584.004 – Server
T1053.002 – At
T1584.001 – Domains
Technical Analysis & Mitigation Measures
Reference Links
Vendor - Produce - Version
synapse - matrix, fedora - fedoraproject
Disclaimer
The content on this website is automatically sourced from external websites such as the National Vulnerability Database (NVD), GitHub, and other security-related sources. This content is for reference purposes only, and we are not responsible for the accuracy or integrity of the information linked or displayed from these sources.