CVEvulnerability

CVE-2023-27043

5.3 MEDIUM Published 2023-04-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-04-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1286, CWE-20

Description

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Affected configurations

• fedoraproject fedora 38 • fedoraproject fedora 39 • netapp active iq unified manager • netapp ontap select deploy administration utility • python python (<= 2.7.18) • python python (>= 3.0 < 3.8.20) • python python (>= 3.9.0 < 3.9.20) • python python (>= 3.10.0 < 3.10.15) • python python (>= 3.11.0 < 3.11.10) • python python (>= 3.12.0 < 3.12.6)

Related

Weakness · CWE (2)

  • CWE-1286 Improper Validation of Syntactic Correctness of Input weakness
  • CWE-20 Improper Input Validation weakness

References