CVE-2023-38686
2 advisories.
PyPI/matrix-sydent CVE-2023-38686: critical 9.3
Sydent does not verify email server certificates
Action: Upgrade matrix-sydent to 2.5.6 or later.
pip install matrix-sydent==2.5.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.6 | - |
Fixed versions
| 2.5.6 |
Sources
- osv: GHSA-p6hw-wm59-3g5g
- https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g
- https://nvd.nist.gov/vuln/detail/CVE-2023-38686
- https://github.com/python/cpython/issues/91826
- https://github.com/matrix-org/sydent/pull/574
- https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261
- https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations
- https://github.com/matrix-org/sydent
- https://github.com/matrix-org/sydent/releases/tag/v2.5.6
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2023-139.yaml
- https://peps.python.org/pep-0476
CVE-2023-38686 · published · modified · JSON
PyPI/matrix-sydent CVE-2023-38686: medium 5.3
Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Syden
Action: Upgrade matrix-sydent to 2.5.6 or later.
pip install matrix-sydent==2.5.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.6 | - |
Fixed versions
| 2.5.6 |
Sources
- osv: PYSEC-2023-139
- https://github.com/python/cpython/issues/91826
- https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261
- https://github.com/matrix-org/sydent/releases/tag/v2.5.6
- https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g
- https://peps.python.org/pep-0476/
- https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations
- https://github.com/matrix-org/sydent/pull/574
CVE-2023-38686 · published · modified · JSON