Matrix Sydent mishandles emails

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-11340 · ADVISORY
• matrix-org/sydent commit 4e1cfff · WEB
• matrix-org/sydent · WEB
• matrix.org/blog/2019/04/18/security-update-sydent-1-0-2 · WEB
• twitter.com/matrixdotorg/status/1118934335963500545 · WEB
• matrix.org/blog/2019/04/18/security-update-sydent-1-0-2 · Release Notes
• pypi.org/project/matrix-sydent · PACKAGE
• GitHub Advisory GHSA-q9h8-gpw5-c95c · ADVISORY

More vulnerabilities in matrix-sydent

• CVE-2023-38686MEDIUM 5.3Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent …
• CVE-2021-29432MEDIUM 5.7Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address…
• CVE-2021-29431MEDIUM 6.5Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter …
• CVE-2021-29430HIGH 7.5Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user cou…
• CVE-2021-29433MEDIUM 4.3Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoin…