Lack of data validation In python3
Description
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.19 | 3.11.10-r0 | ||
alpine v3.20 | 3.12.6-r0 | ||
alpine v3.21 | 3.12.6-r0 | ||
 debian 12 | 3.11.2-6+deb12u5 | ||
alpine v3.17 | 3.10.15-r0 | ||
alpine v3.18 | 3.11.10-r0 | ||
alpine v3.22 | 3.12.6-r0 | ||
debian 12 | 7.3.11+dfsg-2+deb12u3 | ||
debian 13 | 7.3.17+dfsg-3 | ||
debian 14 | 7.3.17+dfsg-3 |
1-10 of 26
10
Aliases
References