CVE-2021-21273

Synapse is a Matrix reference homeserver written in python (pypi package
matrix-synapse). Matrix is an ecosystem for open federated Instant
Messaging and VoIP. In Synapse before version 1.25.0, requests to user
provided domains were not restricted to external IP addresses when
calculating the key validity for third-party invite events and sending push
notifications. This could cause Synapse to make requests to internal
infrastructure. The type of request was not controlled by the user,
although limited modification of request bodies was possible. For the most
thorough protection server administrators should remove the deprecated
federation_ip_range_blacklist from their settings after upgrading to
Synapse v1.25.0 which will result in Synapse using the improved default IP
address restrictions. See the new ip_range_blacklist and
ip_range_whitelist settings if more specific control is necessary.