GitHub Advisoryadvisory · PyPI
GHSA-mh74-4m5g-fcjx Malicious users could abuse Sydent to control the content of invitation emails
MEDIUM
Official page ↗
- Aliases
- CVE-2021-29432
- Ecosystem
- PyPI
- Packages
- matrix-sydent
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-20
- Reviewed
- 2021-04-15
Affected packages
• PyPI matrix-sydent: < 2.3.0 → fixed in 2.3.0
Description
Impact
A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example.
Patches
Fixed in 4469d1d, 6b405a8, 65a6e91.
Note that these patches include changes to the *default* email templates. If these templates have been locally modified, they must also be updated.
For more information
If you have any questions or comments about this advisory, email us at [email protected].
Related
Alias · CVE (1)
- CVE-2021-29432 Sydent is a reference matrix identity server. vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx web
- https://nvd.nist.gov/vuln/detail/CVE-2021-29432 advisory
- https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42 web
- https://github.com/matrix-org/sydent/releases/tag/v2.3.0 web
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2021-23.yaml web
- https://pypi.org/project/matrix-sydent web