Detections
Analytics
SCA: security update for matrix-synapse (GHSA-5wrh-4jwv-5w78)
high Tenable Self-Hosted Container Security Plugin ID 411063
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an
ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user
provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used.
Outbound requests to federation, identity servers, when calculating the key validity for third-party
invite events, sending push notifications, and generating URL previews are affected. This could cause
Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security
advisory for details and workarounds. (CVE-2021-21392)
See Also
Plugin Details
Severity: High
ID: 411063
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3.5
Percentile: 51.63
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 4.9
Temporal Score: 3.6
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N
CVSS Score Source: CVE-2021-21392
CVSS v3
Risk Factor: Medium
Base Score: 6.3
Temporal Score: 5.5
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 7.1
Threat Score: 5
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 4/13/2021
Vulnerability Publication Date: 4/12/2021
Reference Information
CVE: CVE-2021-21392
cwe: CWE-601