CVE-2023-27043

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.(CVE-2023-27043)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.(CVE-2023-27043)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.(CVE-2023-27043)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py (CVE-2022-40897)
• python-cryptography: memory corruption via immutable objects (CVE-2023-23931)
• python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043)
• python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

• CVE-2023-27043: reject malformed addresses in email.parseaddr()

• CVE-2023-27043: reject malformed addresses in email.parseaddr()

• Remove -b option, use original maintainer approach
• CVE-2023-27043: reject malformed addresses in email.parseaddr()

• Remove -b option, use original maintainer approach
• Fix expat regression tests for xml_etree
• CVE-2022-48564: Improve validation of Plist files that prevent DoS
• CVE-2023-40217: Fix TLS handshake bypass
• CVE-2023-27043: reject malformed addresses in email.parseaddr()

• Remove -b option, use original maintainer approach
• Fix expat regression tests for xml_etree
• CVE-2022-48564: Improve validation of Plist files that prevent DoS
• CVE-2023-40217: Fix TLS handshake bypass
• CVE-2023-27043: reject malformed addresses in email.parseaddr()

• Remove -b option, use original maintainer approach
• CVE-2023-27043: reject malformed addresses in email.parseaddr()

• Bugfix for CVE-2023-27043, use str instead of unicode, adjust tests according to python2 specification.

• Bugfix for CVE-2023-27043, use str instead of unicode, adjust tests according to python2 specification.

• Bugfix for CVE-2023-27043, use str instead of unicode, adjust tests according to python2 specification.

• SECURITY UPDATE: Incorrect parsing of email addresses containing special characters
  • debian/patches/CVE-2023-27043.patch: Fix email address parsing errors by adding optional 'strict' parameter to getaddresses() and parseaddr() functions
  • CVE-2023-27043

• SECURITY UPDATE: Incorrect parsing of email addresses containing special characters
  • debian/patches/CVE-2023-27043.patch: Fix email address parsing errors by adding optional 'strict' parameter to getaddresses() and parseaddr() functions
  • debian/patches/fix-urllib2-test.patch: Fix error in test_issue16464() by rewriting it with a local HTTP server instead of an external resource
  • CVE-2023-27043

• SECURITY UPDATE: Incorrect parsing of email addresses containing special characters
  • debian/patches/CVE-2023-27043.patch: Fix email address parsing errors by adding optional 'strict' parameter to getaddresses() and parseaddr() functions
  • debian/patches/fix-urllib2-test.patch: Fix error in test_issue16464() by rewriting it with a local HTTP server instead of an external resource
  • CVE-2023-27043

• SECURITY UPDATE: Incorrect parsing of email addresses containing special characters

• debian/patches/CVE-2023-27043.patch: Fix email address parsing errors by adding optional 'strict' parameter to getaddresses() and parseaddr() functions
• CVE-2023-27043

• CVE-2023-27043: add a strict parsing mode to prevent incorrect address interpretation. By default, strict=True is enabled. If you need the legacy behavior, explicitly set strict=False when calling parseaddr() or getaddresses()
• Additionally, strict parsing can be disabled globally by setting the environment variable PYTHON_EMAIL_DISABLE_STRICT_ADDR_PARSING to a non-empty string or by creating the configuration file /etc/python/email.cfg with the following content: [email_addr_parsing] PYTHON_EMAIL_DISABLE_STRICT_ADDR_PARSING = true

• SECURITY UPDATE: fix quadratic complexity in http cookie parsing with backslash escapes
  • debian/patches/CVE-2024-7592.patch: fix quadratic complexity in http cookie parsing with backslash escapes
  • CVE-2024-7592
• SECURITY UPDATE: reject leading dashes in webbrowser URLs and %action substitution bypass
  • debian/patches/CVE-2026-4519.patch: reject leading dashes in webbrowser URLs and %action substitution bypass
  • CVE-2026-4519
• SECURITY UPDATE: fix quadratic complexity in os.path.expandvars()
  • debian/patches/CVE-2025-6075.patch: fix quadratic complexity in os.path.expandvars()
  • CVE-2025-6075
• SECURITY UPDATE: remove quadratic behavior in xml.dom.minidom node id-cache clearing
  • debian/patches/CVE-2025-12084.patch: remove quadratic behavior in xml.dom.minidom node id-cache clearing
  • CVE-2025-12084
• SECURITY UPDATE: remove backtracking when parsing tarfile PAX headers
  • debian/patches/CVE-2024-6232.patch: remove backtracking when parsing tarfile PAX headers
  • CVE-2024-6232
• SECURITY UPDATE: reject malformed addresses in email.utils.parseaddr / getaddresses
  • debian/patches/CVE-2023-27043.patch: reject malformed addresses in email.utils.parseaddr / getaddresses
  • CVE-2023-27043

• SECURITY UPDATE: Bleichenbacher/Marvin timing oracle in RSA PKCS#1 v1.5 decryption. Distinguishing a padding failure from a successful decryption, by error or by plaintext length, lets an attacker with chosen ciphertexts recover the plaintext of an intercepted message. This is the incomplete-fix follow-up to CVE-2020-25659.
  • debian/patches/CVE-2023-50782.patch: expose Cryptography_HAS_IMPLICIT_RSA_REJECTION from the linked OpenSSL headers in src/_cffi_src/openssl/rsa.py, and skip the PKCS1v15 padding-error assertion when that OpenSSL implicitly rejects invalid padding, in tests/hazmat/primitives/test_rsa.py.
  • The behaviour that closes the oracle comes from OpenSSL implicit rejection (LP: #2054090); built against an OpenSSL without it the constant compiles as 0 and this package behaves as before.
  • CVE-2023-50782
• Build fix: call email.utils.parseaddr with strict=False in src/cryptography/x509/general_name.py. The ELS python2.7 and python3.6 carry CVE-2023-27043.patch, whose strict parser guards on isinstance(addr, str); on Python 2 that is bytes, so every unicode argument yields ('', '') and RFC822Name rejects valid addresses, which breaks collection of the package test suite.
  • debian/patches/fix-parseaddr-call.patch: same workaround the centos7els branch of this package already carries.

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. (CVE-2024-0397) The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. (CVE-2024-4032) The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. (CVE-2024-6923) When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected. (CVE-2024-8088) Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives. (CVE-2024-6232) When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value. (CVE-2024-7592) Urlparse insufficient validation leads to open redirect. (CVE-2015-2104) The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

These are all security issues fixed in the python312-3.12.0b4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.12-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.17-3.1 package on the GA media of openSUSE Tumbleweed.