Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse     instances with the media repository enabled can be tricked into downloading a file from a remote server     into an arbitrary directory. No authentication is required for the affected endpoint. The last 2     directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an     attacker, which limits the impact. Homeservers with the media repository disabled are unaffected.
    Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname,     including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or     later. Server administrators using a reverse proxy could, at the expense of losing media functionality,     may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be     adapted to use the hardened systemd config. (CVE-2021-41281)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse
    instances with the media repository enabled can be tricked into downloading a file from a remote server
    into an arbitrary directory. No authentication is required for the affected endpoint. The last 2
    directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an
    attacker, which limits the impact. Homeservers with the media repository disabled are unaffected.
    Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname,
    including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or
    later. Server administrators using a reverse proxy could, at the expense of losing media functionality,
    may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be
    adapted to use the hardened systemd config. (CVE-2021-41281)

ID	Name	Product	Family	Severity
256012	Linux Distros Unpatched Vulnerability : CVE-2021-41281	Nessus	Misc.	high
427255	Alpine: multiple synapse packages: security update to 1.47.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427255	Alpine: multiple synapse packages: security update to 1.47.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
409545	SCA: security update for matrix-synapse (GHSA-3hfw-x7gx-437c)	Tenable Cloud Security	SCA Checks	high
409545	SCA: security update for matrix-synapse (GHSA-3hfw-x7gx-437c)	Tenable Self-Hosted Container Security	SCA Checks	high
407305	Alpine: multiple synapse packages: security update to 1.47.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407305	Alpine: multiple synapse packages: security update to 1.47.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high

Detections

Analytics

CVE-2021-41281

high

Tenable Plugins

high

high

high

high

high

high

high