S7Evink

**Name of the Vulnerable Software and Affected Versions** Gomatrixserverlib (affected versions not specified) **Description** Gomatrixserverlib is a Go library for matrix federation. It is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The issue allows access to certain content under specific conditions. Users are advised to upgrade to fix the issue. As a mitigation measure, users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access. **Recommendations** For all affected versions, users are advised to upgrade to a version that includes the commit `c4f1e01` to fix the issue. As a temporary workaround, consider using a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access, until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Matrix Media Repo (MMR) versions prior to 1.3.8 **Description** Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This issue allows MMR to serve content from a private network, potentially exposing sensitive information. Users are advised to upgrade to a fixed version. **Recommendations** For versions prior to 1.3.8, upgrade to version 1.3.8 or later to resolve the issue. As a temporary workaround, consider restricting which hosts MMR is allowed to contact via local firewall rules or a transparent proxy to minimize the risk of exploitation.