{"action":"Upgrade matrix-sydent to 2.5.6 or later.","affected":[{"fixed":"2.5.6","introduced":"0"}],"component":"matrix-sydent","cve_ids":["CVE-2023-38686"],"ecosystem":"PyPI","epss":0.00265,"exploited":false,"fixed_versions":["2.5.6"],"ghsa_id":"GHSA-p6hw-wm59-3g5g","id":"tcs_01M5KGJFZDKEDH3BZEZ2Q02FQX","modified_at":"2023-11-08T04:13:09.175295Z","published_at":"2023-08-04T16:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-139","https://github.com/python/cpython/issues/91826","https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261","https://github.com/matrix-org/sydent/releases/tag/v2.5.6","https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g","https://peps.python.org/pep-0476/","https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations","https://github.com/matrix-org/sydent/pull/574"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2023-139","url":"https://osv.dev/vulnerability/PYSEC-2023-139"}],"summary":"Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Syden"}