CVE-2021-29432: PYSEC-2021-23 - Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address

CVE-2021-29432 · Severity: low · CVSS 3.1 · Published 2021-04-15

Technologies: matrix-sydent (PyPI). Vendors: PyPI.

Executive brief

Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.

Affected products

PyPI matrix-sydent

Related threats

PYSEC-2026-2620 - matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG
PYSEC-2026-843 - Matrix Sydent mishandles emails
PYSEC-2023-139 - Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent
PYSEC-2021-22 - Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter
PYSEC-2021-21 - Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user cou