SB2021041242 - Multiple vulnerabilities in Synapse

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021041242

SB2021041242 - Multiple vulnerabilities in Synapse

Published: April 12, 2021 Updated: May 4, 2026

Security Bulletin ID SB2021041242
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2021-21394)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in third-party identifier confirmation endpoints when handling crafted parameters. A remote attacker can send specially crafted requests to cause a denial of service.

The issue can lead to excessive use of disk space and memory due to resource exhaustion.


2) Input validation error (CVE-ID: CVE-2021-21393)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in groups/communities endpoints when handling requests with crafted parameter values. A remote attacker can send specially crafted requests to cause a denial of service.

Exploitation can lead to excessive use of disk space and memory, and clients may have issues rendering large fields.


3) Improper access control (CVE-ID: CVE-2021-21392)

The vulnerability allows a remote attacker to make the server send requests to internal infrastructure.

The vulnerability exists due to improper access control in outbound request handling when processing user-provided domains with transitional IPv6 addresses on dual-stack networks. A remote attacker can provide a crafted domain that resolves to a transitional IPv6 address to make the server send requests to internal infrastructure.

Outbound requests to federation, identity servers, third-party invite key validity checks, push notifications, and URL preview generation are affected.


Remediation

Install update from vendor's website.

References