id: PYSEC-2023-139
modified: 2023-08-17T03:22:32.583512Z
published: 2023-08-04T16:15:00Z
aliases:
- CVE-2023-38686
- GHSA-p6hw-wm59-3g5g
details: Sydent is an identity server for the Matrix communications protocol. Prior
  to version 2.5.6, if configured to send emails using TLS, Sydent does not verify
  SMTP servers' certificates. This makes  Sydent's emails vulnerable to interception
  via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network
  can intercept room invitations and address confirmation emails. This is patched
  in Sydent 2.5.6. When patching, make sure that Sydent trusts the certificate of
  the server it is connecting to. This should happen automatically when using properly
  issued certificates. Those who use self-signed certificates should make sure to
  copy their Certification Authority certificate, or their self signed certificate
  if using only one, to the trust store of your operating system. As a workaround,
  one can ensure Sydent's emails fail to send by setting the configured SMTP server
  to a loopback or non-routable address under one's control which does not have a
  listening SMTP server.
affected:
- package:
    ecosystem: PyPI
    name: matrix-sydent
    purl: pkg:pypi/matrix-sydent
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 1cd748307c6b168b66154e6c4db715d4b9551261
    repo: https://github.com/matrix-org/sydent
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.5.6
  versions:
  - 2.0.0
  - 2.0.1
  - 2.1.0
  - 2.2.0
  - 2.3.0
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
  - 2.4.6
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.5.3
  - 2.5.4
  - 2.5.5
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
references:
- type: REPORT
  url: https://github.com/python/cpython/issues/91826
- type: FIX
  url: https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261
- type: WEB
  url: https://github.com/matrix-org/sydent/releases/tag/v2.5.6
- type: ADVISORY
  url: https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g
- type: WEB
  url: https://peps.python.org/pep-0476/
- type: WEB
  url: https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations
- type: REPORT
  url: https://github.com/matrix-org/sydent/pull/574
- type: FIX
  url: https://github.com/matrix-org/sydent/pull/574