CVE-2021-29431
2 advisories.
PyPI/matrix-sydent CVE-2021-29431: high 7.7, EPSS 1.19%
SSRF in Sydent due to missing validation of hostnames
Action: Upgrade matrix-sydent to 2.3.0 or later.
pip install matrix-sydent==2.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.3.0 | - |
Fixed versions
| 2.3.0 |
Sources
- osv: GHSA-9jhm-8m8c-c3f4
- https://github.com/matrix-org/sydent/security/advisories/GHSA-9jhm-8m8c-c3f4
- https://nvd.nist.gov/vuln/detail/CVE-2021-29431
- https://github.com/matrix-org/sydent/commit/0f00412017f25619bc36c264b29ea96808bf310a
- https://github.com/matrix-org/sydent/commit/3d531ed50d2fd41ac387f36d44d3fb2c62dd22d3
- https://github.com/matrix-org/sydent/commit/8936925f561b0c352c2fa922d5097d7245aad00a
- https://github.com/matrix-org/sydent/commit/9e573348d81df8191bbe8c266c01999c9d57cd5f
- https://github.com/matrix-org/sydent
- https://github.com/matrix-org/sydent/releases/tag/v2.3.0
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2021-22.yaml
- https://pypi.org/project/matrix-sydent
CVE-2021-29431 · published · modified · JSON
PyPI/matrix-sydent CVE-2021-29431: unknown, EPSS 1.19%
Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to
Action: Upgrade matrix-sydent to 2.3.0 or later.
pip install matrix-sydent==2.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.3.0 | - |
Fixed versions
| 2.3.0 |
Sources
- osv: PYSEC-2021-22
- https://github.com/matrix-org/sydent/commit/3d531ed50d2fd41ac387f36d44d3fb2c62dd22d3
- https://github.com/matrix-org/sydent/commit/0f00412017f25619bc36c264b29ea96808bf310a
- https://github.com/matrix-org/sydent/security/advisories/GHSA-9jhm-8m8c-c3f4
- https://github.com/matrix-org/sydent/commit/9e573348d81df8191bbe8c266c01999c9d57cd5f
- https://github.com/matrix-org/sydent/commit/8936925f561b0c352c2fa922d5097d7245aad00a
- https://pypi.org/project/matrix-sydent/
- https://github.com/matrix-org/sydent/releases/tag/v2.3.0
CVE-2021-29431 · published · modified · JSON