CVE-2023-27043

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type

GIT

Repo

https://github.com/python/cpython

Events

Introduced

Last affected

8d21aa21f2cbc6d50aab3f420bb23be1d081dac4

Introduced

6046c5e0298c25515ea58abc8ab87f7413e3f743

Fixed

39b2f82717a69dde7212bc39b673b0f55c99e6a3

Introduced

9cf6752276e6fcfd0c23fdb064ad27f448aaaf75

Fixed

8c3f7946ec848ec16cf28418c0f984ecaa029541

Introduced

b494f5935c92951e75597bfe1c8b1f3112fec270

Fixed

ffee63f34445412322a7afc2535731be221cabba

Introduced

deaf509e8fc6e0363bd6f26d52ad42f976ec42f2

Fixed

0c47759eee3e170e04a5dae82f12f6b375ae78f7

Introduced

0fb18b02c8ad56299d6a2910be0bab8ad601ef24

Fixed

a4a2d2b0d85273f746c3834ce2753e19c898949d

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.18"
        },
        {
            "introduced": "3.0"
        },
        {
            "fixed": "3.8.20"
        },
        {
            "introduced": "3.9.0"
        },
        {
            "fixed": "3.9.20"
        },
        {
            "introduced": "3.10.0"
        },
        {
            "fixed": "3.10.15"
        },
        {
            "introduced": "3.11.0"
        },
        {
            "fixed": "3.11.10"
        },
        {
            "introduced": "3.12.0"
        },
        {
            "fixed": "3.12.6"
        }
    ]
}

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "38"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "39"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-27043.json"