CVE-2021-21392: 
Python vulnerability analysis and mitigation

CVE-2021-21392 affects Matrix Synapse, a Matrix reference homeserver written in Python. The vulnerability allows IP blacklist bypass via transitional IPv6 addresses on dual-stack networks. The issue was discovered in versions prior to 1.28.0 and was patched in version 1.28.0 (GitHub Advisory).

The vulnerability affects outbound requests to federation, identity servers, key validity calculations for third-party invite events, push notifications, and URL preview generation. On dual-stack networks, Synapse failed to properly restrict requests to external IP addresses when transitional IPv6 addresses were used, which could allow requests to internal infrastructure (GitHub Advisory).

This vulnerability could enable Synapse to make unauthorized requests to internal infrastructure on dual-stack networks, potentially exposing sensitive internal services or systems (GitHub Advisory).

As a temporary workaround, outbound requests to the following address ranges can be blocked by a firewall if unused for internal communication: ::ffff/80, ::0000/80, and 2002::/16. However, the recommended solution is to upgrade to Synapse version 1.28.0 or later which contains the fix (GitHub Advisory).