CVE-2021-21392

Advisory

Synapse 1.28.0 includes a fix for CVE-2021-21392: In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when using transitional IPv6 addresses. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks.
https://github.com/matrix-org/synapse/security/advisories/GHSA-5wrh-4jwv-5w78

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21392
• https://pypi.org/project/matrix-synapse/
• https://github.com/matrix-org/synapse/security/advisories/GHSA-5wrh-4jwv-5w78
• https://github.com/matrix-org/synapse/pull/9240
• https://lists.fedoraproject.org/archives/list/[email protected]/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/