Detections
Analytics
SCA: security update for matrix-synapse (GHSA-2hwx-mjrm-v3g8)
medium Tenable Self-Hosted Container Security Plugin ID 408949
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an
ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious
homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of
service attack where homeservers will consume significantly more resources when requesting the .well-known
file of a malicious homeserver. This affects any server which accepts federation requests from untrusted
servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting
can be used to restrict the homeservers communicated with over federation. (CVE-2021-21274)
See Also
Plugin Details
Severity: Medium
ID: 408949
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS Score Source: CVE-2021-21274
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.3
Threat Score: 1.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/1/2021
Vulnerability Publication Date: 2/26/2021
Reference Information
CVE: CVE-2021-21274