PT-2023-26550 · Sydent · Sydent

Martin Schobert · Published 2023-07-31 · Updated 2023-08-10 · CVE-2023-38686

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sydent versions prior to 2.5.6

Description Sydent is an identity server for the Matrix communications protocol. If configured to send emails using TLS, Sydent does not verify SMTP servers' certificates, making its emails vulnerable to interception via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network can intercept room invitations and address confirmation emails. This issue is patched in Sydent 2.5.6. When patching, ensure that Sydent trusts the certificate of the server it is connecting to, which should happen automatically when using properly issued certificates. Those who use self-signed certificates should copy their Certification Authority certificate or their self-signed certificate to the trust store of their operating system.

Recommendations For versions prior to 2.5.6, update to Sydent 2.5.6 to resolve the issue. When patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. If you are using self-signed certificates, make sure to copy your Certification Authority certificate, or your self-signed certificate if using only one, to the trust store of your operating system. As a temporary workaround, consider setting the configured SMTP server to a loopback or non-routable address under your control which does not have a listening SMTP server.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2023-38686

GHSA-P6HW-WM59-3G5G

PYSEC-2023-139

Affected Products

Sydent

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38686.json · Exploit
• https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g · Vendor Advisory
• https://github.com/matrix-org/sydent/pull/574 · Patch
• https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261 · Patch
• https://cve.org/CVERecord?id=CVE-2023-38686 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-38686 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-139 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38686 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38686 · Security Note
• https://ubuntu.com/security/CVE-2023-38686 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p6hw-wm59-3g5g · Vendor Advisory
• https://github.com/python/cpython/issues/91826 · Note
• https://github.com/matrix-org/sydent/releases/tag/v2.5.6 · Note
• https://github.com/matrix-org/sydent · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2023-139.yaml · Note