cbcvebase.
CVE-2023-27043
published 2023-04-19

CVE-2023-27043: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is…

PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
2.53%
83.1th percentile
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Affected

24 ranges
VendorProductVersion rangeFixed in
applemacos_sequoia
debianpypy3< pypy3 7.3.11+dfsg-2+deb12u3 (bookworm)pypy3 7.3.11+dfsg-2+deb12u3 (bookworm)
debianpython2.7< pypy3 7.3.11+dfsg-2+deb12u3 (bookworm)pypy3 7.3.11+dfsg-2+deb12u3 (bookworm)
debianpython3.11< pypy3 7.3.11+dfsg-2+deb12u3 (bookworm)pypy3 7.3.11+dfsg-2+deb12u3 (bookworm)
debianpython3.9< pypy3 7.3.11+dfsg-2+deb12u3 (bookworm)pypy3 7.3.11+dfsg-2+deb12u3 (bookworm)
fedoraprojectfedora
fedoraprojectfedora
msrcazl3_python3_3.12.0-1_on_azure_linux_3.0
msrcazl3_python3_3.12.9-10_on_azure_linux_3.0
msrcazl3_python3_3.12.9-4_on_azure_linux_3.0
msrcazl3_python3_3.12.9-5_on_azure_linux_3.0
msrcazl3_python3_3.12.9-6_on_azure_linux_3.0
msrcazl3_python3_3.12.9-7_on_azure_linux_3.0
msrcazl3_python3_3.12.9-8_on_azure_linux_3.0
msrcazl3_python3_3.12.9-9_on_azure_linux_3.0
msrcazl3_tensorflow_2.16.1-9_on_azure_linux_3.0
msrccbl2_python3_3.9.19-9_on_cbl_mariner_2.0
paloaltocortex_xdr
pythonpython<= 2.7.18
pythonpython>= 3.0 < 3.8.203.8.20
pythonpython>= 3.10.0 < 3.10.153.10.15
pythonpython>= 3.11.0 < 3.11.103.11.10
pythonpython>= 3.12.0 < 3.12.63.12.6
pythonpython>= 3.9.0 < 3.9.203.9.20

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_msrc5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.