id: PYSEC-2021-23
details: Sydent is a reference matrix identity server. A malicious user could abuse
  Sydent to send out arbitrary emails from the Sydent email address. This could be
  used to construct plausible phishing emails, for example. This issue has been fixed
  in 4469d1d.
affected:
- package:
    name: matrix-sydent
    ecosystem: PyPI
    purl: pkg:pypi/matrix-sydent
  ranges:
  - type: GIT
    repo: https://github.com/matrix-org/sydent
    events:
    - introduced: "0"
    - fixed: 4469d1d42b2b1612b70638224c07e19623039c42
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.3.0
  versions:
  - 2.0.0
  - 2.0.1
  - 2.1.0
  - 2.2.0
references:
- type: ADVISORY
  url: https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx
- type: FIX
  url: https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42
- type: PACKAGE
  url: https://pypi.org/project/matrix-sydent/
- type: WEB
  url: https://github.com/matrix-org/sydent/releases/tag/v2.3.0
aliases:
- CVE-2021-29432
- GHSA-mh74-4m5g-fcjx
modified: "2021-04-22T15:25:00Z"
published: "2021-04-15T21:15:00Z"