{"action":"Upgrade matrix-sydent to 2.5.6 or later.","affected":[{"fixed":"2.5.6","introduced":"0"}],"component":"matrix-sydent","cve_ids":["CVE-2023-38686"],"ecosystem":"PyPI","epss":0.00265,"exploited":false,"fixed_versions":["2.5.6"],"ghsa_id":"GHSA-p6hw-wm59-3g5g","id":"tcs_01M5KFSGDX5WGQDT829B85BN88","modified_at":"2026-09-10T03:49:42.620747023Z","published_at":"2023-07-31T22:03:44Z","references":["https://osv.dev/vulnerability/GHSA-p6hw-wm59-3g5g","https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g","https://nvd.nist.gov/vuln/detail/CVE-2023-38686","https://github.com/python/cpython/issues/91826","https://github.com/matrix-org/sydent/pull/574","https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261","https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations","https://github.com/matrix-org/sydent","https://github.com/matrix-org/sydent/releases/tag/v2.5.6","https://github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2023-139.yaml","https://peps.python.org/pep-0476"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-p6hw-wm59-3g5g","url":"https://osv.dev/vulnerability/GHSA-p6hw-wm59-3g5g"}],"summary":"Sydent does not verify email server certificates"}