Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2023-27043 →
UBUNTU-CVE-2023-27043
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:Pro:14.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.6+esm20"}]}]
Ubuntu:Pro:14.04:LTS
python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.4~14.04.1+esm3"}]}]
Ubuntu:Pro:14.04:LTS
python3.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.12-1ubuntu0~16.04.18+esm18"}]}]
Ubuntu:Pro:16.04:LTS
python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.13+esm15"}]}]
Ubuntu:Pro:18.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.13+esm13"}]}]
Ubuntu:Pro:18.04:LTS
python3.6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
python3.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
python3.8
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
python3.8
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.10-0ubuntu1~20.04.12"}]}]
Ubuntu:Pro:20.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.4+esm3"}]}]
Ubuntu:Pro:20.04:LTS
python3.9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
python3.10
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.12-1~22.04.6"}]}]
Ubuntu:Pro:22.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-13ubuntu1.2+esm3"}]}]
Ubuntu:Pro:22.04:LTS
python3.11
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
python3.12
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.3-1ubuntu0.2"}]}]
Références
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- report ubuntu.com
- report github.com
- report github.com
- report python-security.readthedocs.io
- report cve.org