CVE-2019-11340

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-19 · updated 2026-06-17
Weakness: CWE-20

Description

util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.

Affected products

matrix-org sydent: before 1.0.2 — fixed in 1.0.2

How to fix

Upgrade to a fixed version: matrix-org sydent 1.0.2. Check the vendor advisory for mitigations.

References

https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fc
https://github.com/matrix-org/sydent/compare/7c002cd...09278fb
https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/
https://twitter.com/matrixdotorg/status/1118934335963500545
https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fc
https://github.com/matrix-org/sydent/compare/7c002cd...09278fb
https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/
https://twitter.com/matrixdotorg/status/1118934335963500545

Get alerted when CVE-2019-11340 or the next vulnerability affects your stack