util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the…

Description

util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on [email protected]@good.example.com returns the [email protected] substring.

Scores

EPSS (exploitation in 30 days)

1.9% · top 21% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

• n/a
• CWE-20 (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• PyPImatrix-sydentGHSA-q9h8-gpw5-c95c (opens in a new tab)

References (4)

• https://twitter.com/matrixdotorg/status/1118934335963500545 (opens in a new tab)x_refsource_MISCx_transferred
• https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/ (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fc (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/matrix-org/sydent/compare/7c002cd...09278fb (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-q9h8-gpw5-c95c (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-11340](https://trackcve.app/badge/CVE-2019-11340.svg)](https://trackcve.app/cve/CVE-2019-11340)

Record last updated 4 Aug 2024, 22:48 UTC.