id: PYSEC-2021-22
details: Sydent is a reference Matrix identity server. Sydent can be induced to send
  HTTP GET requests to internal systems, due to lack of parameter validation or IP
  address blacklisting. It is not possible to exfiltrate data or control request headers,
  but it might be possible to use the attack to perform an internal port enumeration.
  This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential
  workaround would be to use a firewall to ensure that Sydent cannot reach internal
  HTTP resources.
affected:
- package:
    name: matrix-sydent
    ecosystem: PyPI
    purl: pkg:pypi/matrix-sydent
  ranges:
  - type: GIT
    repo: https://github.com/matrix-org/sydent
    events:
    - introduced: "0"
    - fixed: 3d531ed50d2fd41ac387f36d44d3fb2c62dd22d3
    - fixed: 0f00412017f25619bc36c264b29ea96808bf310a
    - fixed: 9e573348d81df8191bbe8c266c01999c9d57cd5f
    - fixed: 8936925f561b0c352c2fa922d5097d7245aad00a
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.3.0
  versions:
  - 2.0.0
  - 2.0.1
  - 2.1.0
  - 2.2.0
references:
- type: FIX
  url: https://github.com/matrix-org/sydent/commit/3d531ed50d2fd41ac387f36d44d3fb2c62dd22d3
- type: FIX
  url: https://github.com/matrix-org/sydent/commit/0f00412017f25619bc36c264b29ea96808bf310a
- type: ADVISORY
  url: https://github.com/matrix-org/sydent/security/advisories/GHSA-9jhm-8m8c-c3f4
- type: FIX
  url: https://github.com/matrix-org/sydent/commit/9e573348d81df8191bbe8c266c01999c9d57cd5f
- type: FIX
  url: https://github.com/matrix-org/sydent/commit/8936925f561b0c352c2fa922d5097d7245aad00a
- type: PACKAGE
  url: https://pypi.org/project/matrix-sydent/
- type: WEB
  url: https://github.com/matrix-org/sydent/releases/tag/v2.3.0
aliases:
- CVE-2021-29431
- GHSA-9jhm-8m8c-c3f4
modified: "2021-04-22T15:27:00Z"
published: "2021-04-15T21:15:00Z"