Email Header Injection Vulnerability in CPython
CVE-2024-6923

5.5MEDIUM

Key Information:

Vendor
Python Software Foundation
Status
Cpython
Vendor
CVE Published:
1 August 2024

Summary

There is a MEDIUM severity vulnerability affecting CPython.

The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

Affected Version(s)

CPython 0 < 3.8.20

CPython 3.9.0 < 3.9.20

CPython 3.10.0 < 3.10.15

References

https://github.com/python/cpython/pull/122233
patch
https://github.com/python/cpython/issues/121650
issue-tracking
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Petr Viktorin
Seth Larson
John Whitlock
Bas Bloemsaat
.