Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

matrix-sydent

7 known vulnerabilities (1 critical, 2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 critical, 2 high, 2 medium
Registry
PyPI

Advisories 7

  • CVE-2023-38686Critical 9.3

    Sydent does not verify email server certificates

    Affected: fixed in 2.5.6.

  • SSRF in Sydent due to missing validation of hostnames

    Affected: fixed in 2.3.0.

  • CVE-2021-29432Medium 5.3

    Malicious users could control the content of invitation emails

    Affected: fixed in 2.3.0.

  • Denial of service attack via memory exhaustion

    Affected: fixed in 2.3.0.

  • CVE-2021-29433Medium 4.3

    Denial of service (via resource exhaustion) due to improper input validation

    Affected: fixed in 2.3.0.

  • An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1.

    Affected: fixed in 1.0.3.

  • util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the…

    Affected: fixed in 1.0.2.