CVE-2019-11340
Summary
| CVE | CVE-2019-11340 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-04-19 14:29:00 UTC |
| Updated | 2019-04-22 17:52:00 UTC |
| Description | util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on [email protected]@good.example.com returns the [email protected] substring. |
Risk And Classification
Problem Types: CWE-20
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Comparing 7c002cd...09278fb · matrix-org/sydent · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Require that parsed mail addresses match raw input · matrix-org/sydent@4e1cfff · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Security Update: Sydent 1.0.2 | Matrix.org blog | MISC | matrix.org | Release Notes, Vendor Advisory |
| Matrix 在 Twitter："Security update: Sydent 1.0.2. If you run your own Sydent identity server and use the allowed_local_3pids setting in Synapse to restrict registration per email domain, you must upgrade. Thanks to @fs0c131y for finding the vuln. https://t.co/73Lmf3j2Hv https://t.co/fkeTSdqv8H" | MISC | twitter.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 296076 Oracle Solaris 11.4 Support Repository Update (SRU) 19.3.0 Missing (CPUJAN2020)