Email header injection due to unquoted newlines
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 1.1%
exploitation probability
1.1%top 36% of all CVEs
observed exploitation
nono source reports it
There is a MEDIUM severity vulnerability affecting CPython.
The
email module didn’t properly quote newlines for email headers when
serializing an email message allowing for header injection when an email
is serialized.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected products
Python Software Foundation · CPythonReferences
https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533https://github.com/python/cpython/issues/121650https://github.com/python/cpython/pull/122233https://lists.debian.org/debian-lts-announce/2024/12/msg00000.htmlhttps://lists.debian.org/debian-lts-announce/2025/01/msg00005.htmlhttps://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/