CVE-2019-11340
published 2019-04-19CVE-2019-11340: util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is…
PriorityP429medium5.9CVSS 3.0
AVNACHPRNUINSUCNIHAN
EPSS
1.86%
76.8th percentile
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on [email protected]@good.example.com returns the [email protected] substring.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | python2.7 | < python2.7 2.7.17~rc1-1 (bullseye) | python2.7 2.7.17~rc1-1 (bullseye) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| matrix | sydent | < 1.0.2 | 1.0.2 |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| oracle | communications_operations_monitor | — | — |
| oracle | communications_operations_monitor | 4.1 – 4.3 | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | solaris | — | — |
| oracle | zfs_storage_appliance_kit | — | — |
| python | python | <= 2.7.16 | — |
| python | python | 3.0.0 – 3.0.1 | — |
| python | python | 3.1.0 – 3.1.5 | — |
| python | python | 3.2.0 – 3.2.6 | — |
| python | python | 3.3.0 – 3.3.7 | — |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2019-16056: python2.7 - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x throu...
vendor_debian·2019·CVSS 5.9
CVE-2019-16056 [MEDIUM] CVE-2019-16056: python2.7 - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x throu...
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.
Scope: local
bullseye: resolved (fixed in 2.7.17~rc1-1)
Red Hat
python: email.utils.parseaddr wrongly parses email addresses
vendor_redhat·2018-07-19·CVSS 5.9
CVE-2019-16056 [MEDIUM] CWE-20 python: email.utils.parseaddr wrongly parses email addresses
python: email.utils.parseaddr wrongly parses email addresses
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.
Package: python (Red Hat Enterprise Linux 5) - Out of support scope
Package: python (Red Hat Enterprise Linux 6) - Out of support scope
Package: python36:3.6/python36 (Red Hat Enterprise Linux 8) - Not affected
GHSA
Matrix Sydent mishandles emails
ghsa·2022-05-24
CVE-2019-11340 [MEDIUM] CWE-20 Matrix Sydent mishandles emails
Matrix Sydent mishandles emails
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on [email protected]@good.example.com returns the [email protected] substring.
GHSA
GHSA-8mcc-mjj5-h77m: An issue was discovered in Python through 2
ghsa_unreviewed·2022-05-24·CVSS 5.9
CVE-2019-16056 [MEDIUM] GHSA-8mcc-mjj5-h77m: An issue was discovered in Python through 2
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.
OSV
Matrix Sydent mishandles emails
osv·2022-05-24
CVE-2019-11340 [MEDIUM] Matrix Sydent mishandles emails
Matrix Sydent mishandles emails
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on [email protected]@good.example.com returns the [email protected] substring.
OSV
CVE-2019-16056: An issue was discovered in Python through 2
osv·2019-09-06·CVSS 5.9
CVE-2019-16056 [MEDIUM] CVE-2019-16056: An issue was discovered in Python through 2
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.
No detection rules found.
No public exploits indexed.
https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fchttps://github.com/matrix-org/sydent/compare/7c002cd...09278fbhttps://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/https://twitter.com/matrixdotorg/status/1118934335963500545https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fchttps://github.com/matrix-org/sydent/compare/7c002cd...09278fbhttps://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/https://twitter.com/matrixdotorg/status/1118934335963500545
2019-04-19
Published