Email header injection due to unquoted newlines (CVE-2024-6923)

Résumé

Email header injection due to unquoted newlines

Description d'origine

La description telle que publiée par la source (souvent en anglais).

There is a MEDIUM severity vulnerability affecting CPython.

The
email module didn’t properly quote newlines for email headers when
serializing an email message allowing for header injection when an email
is serialized.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2024-6923 python3 Corrigé dans: 3.10.15-r0
Debian DEBIAN-CVE-2024-6923 pypy3 Corrigé dans: 7.3.5+dfsg-2+deb11u5
Ubuntu UBUNTU-CVE-2024-6923 python2.7 Corrigé dans: 2.7.6-8ubuntu0.6+esm21

Références

advisory github.com
advisory mail.python.org
advisory nvd.nist.gov
advisory security.netapp.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
report github.com
web openwall.com
web openwall.com
web lists.debian.org
web lists.debian.org