← volver
CVE-2024-6923

Email header injection due to unquoted newlines

CVSS 5.5 MEDIUMEPSS 0.7%CWE-94
There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Productos afectados
Python Software Foundation · CPython

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533https://github.com/python/cpython/issues/121650https://github.com/python/cpython/pull/122233https://lists.debian.org/debian-lts-announce/2024/12/msg00000.htmlhttps://lists.debian.org/debian-lts-announce/2025/01/msg00005.htmlhttps://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/