CVE-2019-11340: Input Validation
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowedlocal3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-11340?
CVE-2019-11340 is a vulnerability in Matrix Sydent before version 1.0.2 that mishandles registration restrictions based on e-mail domain, if the allowed_local_3pids option is enabled.
How does CVE-2019-11340 occur?
The vulnerability occurs due to potentially unwanted behavior in Python, where an email.utils.parseaddr call on user@bad.example.net@good.example.net results in mishandling of registration restrictions.
What is the severity of CVE-2019-11340?
The severity of CVE-2019-11340 is medium with a CVSS score of 5.9.
How can I fix CVE-2019-11340?
To fix CVE-2019-11340, upgrade Matrix Sydent to version 1.0.2 or above.
Where can I find more information about CVE-2019-11340?
You can find more information about CVE-2019-11340 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-11340), [GitHub Commit](https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fc), [GitHub Compare](https://github.com/matrix-org/sydent/compare/7c002cd...09278fb).