Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible. For the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an     ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to     user provided domains were not restricted to external IP addresses when calculating the key validity for     third-party invite events and sending push notifications. This could cause Synapse to make requests to     internal infrastructure. The type of request was not controlled by the user, although limited modification     of request bodies was possible. For the most thorough protection server administrators should remove the     deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which     will result in Synapse using the improved default IP address restrictions. See the new     `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.
    (CVE-2021-21273)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an
    ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to
    user provided domains were not restricted to external IP addresses when calculating the key validity for
    third-party invite events and sending push notifications. This could cause Synapse to make requests to
    internal infrastructure. The type of request was not controlled by the user, although limited modification
    of request bodies was possible. For the most thorough protection server administrators should remove the
    deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which
    will result in Synapse using the improved default IP address restrictions. See the new
    `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.
    (CVE-2021-21273)

ID	Name	Product	Family	Severity
259213	Linux Distros Unpatched Vulnerability : CVE-2021-21273	Nessus	Misc.	medium
419213	SCA: security update for matrix-synapse (GHSA-v936-j8gp-9q3p)	Tenable Cloud Security	SCA Checks	medium
419213	SCA: security update for matrix-synapse (GHSA-v936-j8gp-9q3p)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2021-21273

medium

Tenable Plugins

medium

medium

medium