Gomatrixserverlib Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in Gomatrixserverlib, a Go library for Matrix federation. This vulnerability allows the library to access and serve content from a private network, under certain conditions. The issue is present in versions of Gomatrixserverlib through dbd5f31fefc031633c3418165e4ef6d343e03999.

Impact

Exploitation of this vulnerability allows for server-side request forgery, enabling the library to access and serve content from private networks it can reach.

Remediation

Users are advised to upgrade to the version containing the patch. For those unable to upgrade, it is recommended to use a local firewall to restrict the network segments and hosts that the service using Gomatrixserverlib can access.