CVE-2021-21273: 
Python vulnerability analysis and mitigation

CVE-2021-21273 is a security vulnerability affecting Matrix Synapse, a Matrix reference homeserver written in Python. The vulnerability was discovered and disclosed in early 2021, where requests to user-provided domains were not properly restricted to external IP addresses when calculating key validity for third-party invite events and sending push notifications. This could potentially allow Synapse to make requests to internal infrastructure (GitHub Advisory).

The vulnerability stems from insufficient IP address restrictions when handling certain types of requests. Specifically, the issue affected requests related to key validity calculations for third-party invite events and push notification delivery. While the type of request was not controlled by the user, limited modification of request bodies was possible (GitHub Advisory). The vulnerability was assigned a Low severity rating.

The main impact of this vulnerability was that it could allow Synapse to make unauthorized requests to internal infrastructure through user-provided domains. This could potentially expose internal services or systems to unauthorized access or probing (GitHub Advisory).

The vulnerability required the ability to trigger third-party invite events or push notifications. While the type of request was not directly controllable by an attacker, they could perform limited modifications to request bodies (GitHub Advisory).

The issue was resolved in Synapse version 1.25.0. Server administrators were advised to remove the deprecated federation_ip_range_blacklist from their settings after upgrading, which would result in Synapse using improved default IP address restrictions. Alternative configuration options ip_range_blacklist and ip_range_whitelist were provided for more specific control. As a temporary workaround, requests to internal IP addresses could be blocked at the system or network level (GitHub Advisory).