Description
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected products
- Canonical / Ubuntu Linux19.04 – 19.04
- Canonical / Ubuntu Linux12.04 – 12.04
- Canonical / Ubuntu Linux14.04 – 14.04
- Canonical / Ubuntu Linux16.04 – 16.04
- Canonical / Ubuntu Linux18.04 – 18.04
- Debian / debian_linux9.0 – 9.0
- Debian / debian_linux8.0 – 8.0
- fedoraproject / fedora29 – 29
- fedoraproject / fedora30 – 30
- fedoraproject / fedora31 – 31
- openSUSE / Leap15.1 – 15.1
- openSUSE / Leap15.0 – 15.0
- oracle / communications_operations_monitor3.4 – 3.4
- oracle / communications_operations_monitor4.1 – 4.3
- oracle / peoplesoft_enterprise_peopletools8.57 – 8.57
- oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
- oracle / solaris11 – 11
- oracle / zfs_storage_appliance_kit8.8 – 8.8
- Python / python2.7.16
- RedHat / software_collections1.0 – 1.0
References
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2019/09/msg00019.html
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2019/09/msg00018.html
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/
- VENDOR_ADVISORYhttps://usn.ubuntu.com/4151-1/
- VENDOR_ADVISORYhttps://usn.ubuntu.com/4151-2/
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3725
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3948
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2020.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2020.html
- MISChttps://bugs.python.org/issue34155
- PATCHhttps://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9
- MISChttps://security.netapp.com/advisory/ntap-20190926-0005/
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/07/msg00011.html
- MAILING_LISThttps://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/08/msg00034.html
Updated 45m ago · 8 sources