{"action":"Upgrade matrix-sydent to 2.3.0 or later.","affected":[{"fixed":"2.3.0","introduced":"0"}],"component":"matrix-sydent","cve_ids":["CVE-2021-29431"],"ecosystem":"PyPI","epss":0.01194,"exploited":false,"fixed_versions":["2.3.0"],"ghsa_id":"GHSA-9jhm-8m8c-c3f4","id":"tcs_01M5KGBR4E29ZFTX0AWBFZE867","modified_at":"2023-11-08T04:05:33.712503Z","published_at":"2021-04-15T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-22","https://github.com/matrix-org/sydent/commit/3d531ed50d2fd41ac387f36d44d3fb2c62dd22d3","https://github.com/matrix-org/sydent/commit/0f00412017f25619bc36c264b29ea96808bf310a","https://github.com/matrix-org/sydent/security/advisories/GHSA-9jhm-8m8c-c3f4","https://github.com/matrix-org/sydent/commit/9e573348d81df8191bbe8c266c01999c9d57cd5f","https://github.com/matrix-org/sydent/commit/8936925f561b0c352c2fa922d5097d7245aad00a","https://pypi.org/project/matrix-sydent/","https://github.com/matrix-org/sydent/releases/tag/v2.3.0"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-22","url":"https://osv.dev/vulnerability/PYSEC-2021-22"}],"summary":"Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to"}