PyPI/matrix-sydent CVE-2023-38686: medium 5.3, EPSS 0.27%
Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Syden
Action: Upgrade matrix-sydent to 2.5.6 or later.
pip install matrix-sydent==2.5.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.6 | - |
Fixed versions
| 2.5.6 |
Sources
- osv: PYSEC-2023-139
- https://github.com/python/cpython/issues/91826
- https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261
- https://github.com/matrix-org/sydent/releases/tag/v2.5.6
- https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g
- https://peps.python.org/pep-0476/
- https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations
- https://github.com/matrix-org/sydent/pull/574
CVE-2023-38686 · published · modified · JSON