matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-11842 · ADVISORY
• GitHub Advisory GHSA-gwf7-vfjf-wf6x · ADVISORY
• pypa/advisory-database · WEB
• matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a · WEB
• matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a · Vendor Advisory
• pypi.org/project/matrix-sydent · PACKAGE

matrix-sydent のその他の脆弱性

• CVE-2023-38686中 5.3Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent …
• CVE-2021-29432中 5.7Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address…
• CVE-2021-29431中 6.5Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter …
• CVE-2021-29430高 7.5Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user cou…
• CVE-2021-29433中 4.3Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoin…