Open redirect via transitional IPv6 addresses on dual-stack networks
Impact
Requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks.
Patches
This issue is fixed by #9240.
Workarounds
Outbound requests to the following address ranges can be blocked by a firewall, if unused for internal communication between systems:
::ffff/80::0000/80(note that this IP range is considered deprecated by the IETF)2002::/16(note that this IP range is considered deprecated by the IETF)
References
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | matrix-synapse | < 1.28.0rc1 | 1.28.0rc1 |
Referencias
- https://pypi.org/project/matrix-synapse/
- https://github.com/matrix-org/synapse/security/advisories/GHSA-5wrh-4jwv-5w78
- https://github.com/matrix-org/synapse/pull/9240
- https://nvd.nist.gov/vuln/detail/CVE-2021-21392
- https://github.com/matrix-org/synapse/commit/4ca054a4eaa714d0befb4fc30b19a1131e52c9cc
- https://github.com/matrix-org/synapse
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-25.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY
- https://pypi.org/project/matrix-synapse
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N- Debilidad (CWE)
CWE-601- Plataforma
- Python (PyPI)
- Paquete
matrix-synapse- Publicada
- 12.04.2021
- Actualizado
- 11.10.2026 13:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2021-25 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5wrh-4jwv-5w78 - CC BY 4.0
Historial de vulnerabilidades: matrix-synapse
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 45
- Primera → última
- 03.2019 05.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 21
- Media 21
- Baja 3
Divulgaciones por año
- 2019: 3
- 2020: 3
- 2021: 12
- 2022: 7
- 2023: 9
- 2024: 7
- 2025: 2
- 2026: 2
-
Open redirect via transitional IPv6 addresses on dual-stack networks esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.