PT-2021-14380 · Matrix+1 · Synapse+1

Published 2021-02-24 · Updated 2021-11-23 · CVE-2021-21273

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.25.0

Description: The issue concerns Synapse, a Matrix reference homeserver written in python, where requests to user-provided domains were not restricted to external IP addresses when calculating key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible.

Recommendations: For Synapse versions prior to 1.25.0, upgrade to Synapse version 1.25.0. After upgrading, remove the deprecated federation ip range blacklist from settings to use the improved default IP address restrictions. Consider using the new ip range blacklist and ip range whitelist settings for more specific control if necessary. As a temporary workaround, consider blocking requests to internal IP addresses at the system or network level.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2021-1385

CVE-2021-21273

GHSA-V936-J8GP-9Q3P

PYSEC-2021-131

Affected Products

Alt Linux

Synapse

References · 20

• https://github.com/matrix-org/synapse/commit/30fba6210834a4ecd91badf0c8f3eb278b72e746 · Patch
• https://github.com/matrix-org/synapse/pull/8821 · Patch
• https://github.com/matrix-org/synapse/security/advisories/GHSA-v936-j8gp-9q3p · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21273 · Security Note
• https://ubuntu.com/security/CVE-2021-21273 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21273 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21273 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21273 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-131 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21273 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21273 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v936-j8gp-9q3p · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY · Vendor Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.25.0 · Note