Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an     ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user     provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used.
    Outbound requests to federation, identity servers, when calculating the key validity for third-party     invite events, sending push notifications, and generating URL previews are affected. This could cause     Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security     advisory for details and workarounds. (CVE-2021-21392)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an
    ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user
    provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used.
    Outbound requests to federation, identity servers, when calculating the key validity for third-party
    invite events, sending push notifications, and generating URL previews are affected. This could cause
    Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security
    advisory for details and workarounds. (CVE-2021-21392)

ID	Name	Product	Family	Type	Severity
256771	Linux Distros Unpatched Vulnerability : CVE-2021-21392	Nessus	Misc.	Local	medium
411063	SCA: security update for matrix-synapse (GHSA-5wrh-4jwv-5w78)	Tenable Cloud Security	SCA Checks	Local	high
411063	SCA: security update for matrix-synapse (GHSA-5wrh-4jwv-5w78)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2021-21392

high

Tenable Plugins

medium

high

high