PyPI/matrix-sydent CVE-2023-38686: critical 9.3, EPSS 0.27%

Sydent does not verify email server certificates

Action: Upgrade matrix-sydent to 2.5.6 or later.

pip install matrix-sydent==2.5.6

Affected

Fixed versions

Sources

• osv: GHSA-p6hw-wm59-3g5g
• https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g
• https://nvd.nist.gov/vuln/detail/CVE-2023-38686
• https://github.com/python/cpython/issues/91826
• https://github.com/matrix-org/sydent/pull/574
• https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261
• https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations
• https://github.com/matrix-org/sydent
• https://github.com/matrix-org/sydent/releases/tag/v2.5.6
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2023-139.yaml
• https://peps.python.org/pep-0476

CVE-2023-38686 · published 2023-07-31T22:03:44Z · modified 2026-09-10T03:49:42.620747023Z · JSON