id: PYSEC-2021-131
details: Synapse is a Matrix reference homeserver written in python (pypi package
  matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and
  VoIP. In Synapse before version 1.25.0, requests to user provided domains were not
  restricted to external IP addresses when calculating the key validity for third-party
  invite events and sending push notifications. This could cause Synapse to make requests
  to internal infrastructure. The type of request was not controlled by the user,
  although limited modification of request bodies was possible. For the most thorough
  protection server administrators should remove the deprecated `federation_ip_range_blacklist`
  from their settings after upgrading to Synapse v1.25.0 which will result in Synapse
  using the improved default IP address restrictions. See the new `ip_range_blacklist`
  and `ip_range_whitelist` settings if more specific control is necessary.
affected:
- package:
    name: matrix-synapse
    ecosystem: PyPI
    purl: pkg:pypi/matrix-synapse
  ranges:
  - type: GIT
    repo: https://github.com/matrix-org/synapse
    events:
    - introduced: "0"
    - fixed: 30fba6210834a4ecd91badf0c8f3eb278b72e746
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.25.0
  versions:
  - 0.33.5
  - 0.33.5.1
  - 0.33.6
  - 0.33.6rc1
  - 0.33.7
  - 0.33.7rc1
  - 0.33.7rc2
  - 0.33.8
  - 0.33.8rc2
  - 0.33.9
  - 0.34.0
  - 0.34.0.1
  - 0.34.0rc1
  - 0.34.0rc2
  - 0.34.1.1
  - 0.99.0
  - 0.99.0rc1
  - 0.99.0rc2
  - 0.99.0rc3
  - 0.99.0rc4
  - 0.99.1
  - 0.99.1.1
  - 0.99.1rc1
  - 0.99.1rc2
  - 0.99.2
  - 0.99.2rc1
  - 0.99.3
  - 0.99.3.1
  - 0.99.3.2
  - 0.99.3rc1
  - 0.99.4
  - 0.99.4rc1
  - 0.99.5
  - 0.99.5.1
  - 0.99.5.2
  - 0.99.5rc1
  - 1.0.0
  - 1.0.0rc1
  - 1.0.0rc2
  - 1.0.0rc3
  - 1.1.0
  - 1.1.0rc1
  - 1.1.0rc2
  - 1.10.0
  - 1.10.0rc1
  - 1.10.0rc2
  - 1.10.0rc3
  - 1.10.0rc5
  - 1.10.1
  - 1.11.0
  - 1.11.0rc1
  - 1.11.1
  - 1.12.0
  - 1.12.0rc1
  - 1.12.1
  - 1.12.1rc1
  - 1.12.2
  - 1.12.3
  - 1.12.4
  - 1.12.4rc1
  - 1.13.0
  - 1.13.0rc1
  - 1.13.0rc2
  - 1.13.0rc3
  - 1.14.0
  - 1.14.0rc1
  - 1.14.0rc2
  - 1.15.0
  - 1.15.0rc1
  - 1.15.1
  - 1.15.2
  - 1.16.0
  - 1.16.0rc1
  - 1.16.0rc2
  - 1.16.1
  - 1.17.0
  - 1.17.0rc1
  - 1.18.0
  - 1.18.0rc1
  - 1.18.0rc2
  - 1.19.0
  - 1.19.0rc1
  - 1.19.1
  - 1.19.1rc1
  - 1.19.2
  - 1.19.3
  - 1.2.0
  - 1.2.0rc1
  - 1.2.0rc2
  - 1.2.1
  - 1.20.0
  - 1.20.0rc1
  - 1.20.0rc2
  - 1.20.0rc3
  - 1.20.0rc4
  - 1.20.0rc5
  - 1.20.1
  - 1.21.0
  - 1.21.0rc1
  - 1.21.0rc2
  - 1.21.0rc3
  - 1.21.1
  - 1.21.2
  - 1.22.0
  - 1.22.0rc1
  - 1.22.0rc2
  - 1.22.1
  - 1.23.0
  - 1.23.0rc1
  - 1.23.1
  - 1.24.0
  - 1.24.0rc1
  - 1.24.0rc2
  - 1.25.0rc1
  - 1.3.0
  - 1.3.0rc1
  - 1.3.1
  - 1.4.0
  - 1.4.0rc1
  - 1.4.0rc2
  - 1.4.1
  - 1.4.1rc1
  - 1.5.0
  - 1.5.0rc1
  - 1.5.0rc2
  - 1.5.1
  - 1.6.0
  - 1.6.0rc1
  - 1.6.0rc2
  - 1.6.1
  - 1.7.0
  - 1.7.0rc1
  - 1.7.0rc2
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.8.0
  - 1.8.0rc1
  - 1.9.0
  - 1.9.0.dev1
  - 1.9.0.dev2
  - 1.9.0rc1
  - 1.9.1
references:
- type: WEB
  url: https://github.com/matrix-org/synapse/releases/tag/v1.25.0
- type: FIX
  url: https://github.com/matrix-org/synapse/commit/30fba6210834a4ecd91badf0c8f3eb278b72e746
- type: ADVISORY
  url: https://github.com/matrix-org/synapse/security/advisories/GHSA-v936-j8gp-9q3p
- type: WEB
  url: https://github.com/matrix-org/synapse/pull/8821
aliases:
- CVE-2021-21273
- GHSA-v936-j8gp-9q3p
modified: "2021-08-27T03:22:06.569635Z"
published: "2021-02-26T18:15:00Z"