{"schema_version":"1.7.3","id":"GO-2025-3396","published":"2025-01-16T22:53:23Z","modified":"2025-01-16T23:27:18.600557Z","aliases":["CVE-2024-52594","GHSA-4ff6-858j-r822"],"summary":"Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib","details":"Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib","affected":[{"package":{"name":"github.com/matrix-org/gomatrixserverlib","ecosystem":"Go","purl":"pkg:golang/github.com/matrix-org/gomatrixserverlib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20250116181547-c4f1e01eab0d"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/matrix-org/gomatrixserverlib/fclient","symbols":["Client.CreateMediaDownloadRequest","Client.DoHTTPRequest","Client.DoRequestAndParseResponse","Client.GetServerKeys","Client.GetVersion","Client.LookupServerKeys","Client.LookupUserInfo","DNSCache.DialContext","LookupWellKnown","NewClient","NewDNSCache","NewFederationClient","ResolveServer","destinationTripper.RoundTrip","destinationTripper.getTransport","federationClient.Backfill","federationClient.ClaimKeys","federationClient.DoRequestAndParseResponse","federationClient.DownloadMedia","federationClient.ExchangeThirdPartyInvite","federationClient.GetEvent","federationClient.GetEventAuth","federationClient.GetPublicRooms","federationClient.GetPublicRoomsFiltered","federationClient.GetUserDevices","federationClient.LookupMissingEvents","federationClient.LookupProfile","federationClient.LookupRoomAlias","federationClient.LookupState","federationClient.LookupStateIDs","federationClient.MSC2836EventRelationships","federationClient.MakeJoin","federationClient.MakeKnock","federationClient.MakeLeave","federationClient.P2PGetTransactionFromRelay","federationClient.P2PSendTransactionToRelay","federationClient.Peek","federationClient.QueryKeys","federationClient.RoomHierarchy","federationClient.SendInvite","federationClient.SendInviteV2","federationClient.SendInviteV3","federationClient.SendJoin","federationClient.SendJoinPartialState","federationClient.SendKnock","federationClient.SendLeave","federationClient.SendTransaction","newDestinationTripper"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2025-3396.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52594"},{"type":"FIX","url":"https://github.com/matrix-org/gomatrixserverlib/commit/c4f1e01eab0dd435709ad15463ed38a079ad6128"},{"type":"WEB","url":"https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2025-3396"}}