PT-2023-4573 · Python+12 · Python+12
Tdwyer
·
Published
2023-04-18
·
Updated
2026-05-12
·
CVE-2023-27043
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Python versions 0 through 2.7.18
Python versions 3.x through 3.11.3
Description
The email module of Python incorrectly parses e-mail addresses that contain a special character, allowing attackers to bypass protection mechanisms. This can be exploited in applications where access is granted only after verifying receipt of e-mail to a specific domain. The issue is related to insufficient input validation.
Recommendations
For Python versions 0 through 2.7.18, update to a version later than 2.7.18.
For Python versions 3.x through 3.11.3, update to Python 3.13.
As a temporary workaround, consider restricting the use of the email module until a patch is available.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Apple Macos
Python
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu