CVE-2023-38686: Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not v...

Description

Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network can intercept room invitations and address confirmation emails. This is patched in Sydent 2.5.6. When patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. Those who use self-signed certificates should make sure to copy their Certification Authority certificate, or their self signed certificate if using only one, to the trust store of your operating system. As a workaround, one can ensure Sydent's emails fail to send by setting the configured SMTP server to a loopback or non-routable address under one's control which does not have a listening SMTP server.

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

0.23%

13.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-295

Affected Software

Vendor	Product	Versions
Matrix	Sydent	< 2.5.6

References

https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerationsTechnical Description
https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261Patch
https://github.com/matrix-org/sydent/pull/574Issue Tracking, Patch
https://github.com/matrix-org/sydent/releases/tag/v2.5.6Release Notes
https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5gVendor Advisory
https://github.com/python/cpython/issues/91826Issue Tracking
https://peps.python.org/pep-0476/Third Party Advisory
https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerationsTechnical Description
https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261Patch
https://github.com/matrix-org/sydent/pull/574Issue Tracking, Patch
https://github.com/matrix-org/sydent/releases/tag/v2.5.6Release Notes
https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5gVendor Advisory
https://github.com/python/cpython/issues/91826Issue Tracking
https://peps.python.org/pep-0476/Third Party Advisory

Timeline

Published: Aug 4, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-38686?

Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network can intercept room invitations and address confirmation emails. This is patched in Sydent 2.5.6. When patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. Those who use self-signed certificates should make sure to copy their Certification Authority certificate, or their self signed certificate if using only one, to the trust store of your operating system. As a workaround, one can ensure Sydent's emails fail to send by setting the configured SMTP server to a loopback or non-routable address under one's control which does not have a listening SMTP server.

How severe is CVE-2023-38686?

CVE-2023-38686 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.23% probability of exploitation in the next 30 days.

How do I fix CVE-2023-38686?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.