Email header injection due to unquoted newlines (CVE-2024-6923)

Summary

Email header injection due to unquoted newlines

Original description

The description as published by the source.

There is a MEDIUM severity vulnerability affecting CPython.

The
email module didn’t properly quote newlines for email headers when
serializing an email message allowing for header injection when an email
is serialized.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2024-6923 python3 Fixed in: 3.10.15-r0
Debian DEBIAN-CVE-2024-6923 pypy3 Fixed in: 7.3.5+dfsg-2+deb11u5
Ubuntu UBUNTU-CVE-2024-6923 python2.7 Fixed in: 2.7.6-8ubuntu0.6+esm21

References

advisory github.com
advisory mail.python.org
advisory nvd.nist.gov
advisory security.netapp.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
report github.com
web openwall.com
web openwall.com
web lists.debian.org
web lists.debian.org