id: GO-2025-3396
modules:
    - module: github.com/matrix-org/gomatrixserverlib
      versions:
        - fixed: 0.0.0-20250116181547-c4f1e01eab0d
      vulnerable_at: 0.0.0-20241215094829-e86ab16eabe8
      packages:
        - package: github.com/matrix-org/gomatrixserverlib/fclient
          symbols:
            - NewClient
            - destinationTripper.getTransport
            - DNSCache.DialContext
            - newDestinationTripper
            - NewDNSCache
            - destinationTripper.RoundTrip
          derived_symbols:
            - Client.CreateMediaDownloadRequest
            - Client.DoHTTPRequest
            - Client.DoRequestAndParseResponse
            - Client.GetServerKeys
            - Client.GetVersion
            - Client.LookupServerKeys
            - Client.LookupUserInfo
            - LookupWellKnown
            - NewFederationClient
            - ResolveServer
            - federationClient.Backfill
            - federationClient.ClaimKeys
            - federationClient.DoRequestAndParseResponse
            - federationClient.DownloadMedia
            - federationClient.ExchangeThirdPartyInvite
            - federationClient.GetEvent
            - federationClient.GetEventAuth
            - federationClient.GetPublicRooms
            - federationClient.GetPublicRoomsFiltered
            - federationClient.GetUserDevices
            - federationClient.LookupMissingEvents
            - federationClient.LookupProfile
            - federationClient.LookupRoomAlias
            - federationClient.LookupState
            - federationClient.LookupStateIDs
            - federationClient.MSC2836EventRelationships
            - federationClient.MakeJoin
            - federationClient.MakeKnock
            - federationClient.MakeLeave
            - federationClient.P2PGetTransactionFromRelay
            - federationClient.P2PSendTransactionToRelay
            - federationClient.Peek
            - federationClient.QueryKeys
            - federationClient.RoomHierarchy
            - federationClient.SendInvite
            - federationClient.SendInviteV2
            - federationClient.SendInviteV3
            - federationClient.SendJoin
            - federationClient.SendJoinPartialState
            - federationClient.SendKnock
            - federationClient.SendLeave
            - federationClient.SendTransaction
summary: |-
    Server-Side Request Forgery (SSRF) on redirects and federation in
    github.com/matrix-org/gomatrixserverlib
cves:
    - CVE-2024-52594
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-52594
    - fix: https://github.com/matrix-org/gomatrixserverlib/commit/c4f1e01eab0dd435709ad15463ed38a079ad6128
    - web: https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822
source:
    id: CVE-2024-52594
    created: 2025-01-16T21:41:31.447885903Z
review_status: REVIEWED