CVE-2019-16056
Publication date 6 September 2019
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.
Status
Package | Ubuntu Release | Status |
---|---|---|
python2.7 | 24.04 LTS noble | Not in release |
22.04 LTS jammy |
Not affected
|
|
20.04 LTS focal |
Not affected
|
|
18.04 LTS bionic |
Fixed 2.7.15-4ubuntu4~18.04.2
|
|
16.04 LTS xenial |
Fixed 2.7.12-1ubuntu0~16.04.9
|
|
14.04 LTS trusty |
Fixed 2.7.6-8ubuntu0.6+esm3
|
|
python3.4 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty |
Fixed 3.4.3-1ubuntu1~14.04.7+esm4
|
|
python3.5 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial |
Fixed 3.5.2-2ubuntu0~16.04.9
|
|
14.04 LTS trusty |
Fixed 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
|
|
python3.6 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Fixed 3.6.8-1~18.04.3
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
python3.7 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
seth-arnold
This has a very high risk of regression. Email addresses should not be validated beyond making sure there's at least one byte on both sides of an '@' sign. Legal email addresses are significantly more complicated than what is easy to express in regex. Whatever validation this module provides is in my opinion suspect.
Patch details
Package | Patch details |
---|---|
python2.7 |
|
python3.5 |
|
python3.6 |
|
python3.7 |
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 · High |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-4151-1
- Python vulnerabilities
- 9 October 2019
- USN-4151-2
- Python vulnerabilities
- 10 October 2019
- USN-6891-1
- Python vulnerabilities
- 11 July 2024