CVE-2019-11340: Improper Input Validation
(updated )
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.
References
- github.com/advisories/GHSA-q9h8-gpw5-c95c
- github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fc
- github.com/matrix-org/sydent/compare/7c002cd...09278fb
- matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/
- nvd.nist.gov/vuln/detail/CVE-2019-11340
- twitter.com/matrixdotorg/status/1118934335963500545
Code Behaviors & Features
Detect and mitigate CVE-2019-11340 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →