CVE-2019-16056

Published: 6 September 2019

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Priority

Medium

CVSS 3 base score: 7.5

Status

Notes

This has a very high risk of regression. Email addresses should
not be validated beyond making sure there's at least one byte on both
sides of an '@' sign. Legal email addresses are significantly more
complicated than what is easy to express in regex.
Whatever validation this module provides is in my opinion suspect.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056
• https://ubuntu.com/security/notices/USN-4151-1
• https://ubuntu.com/security/notices/USN-4151-2
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.python.org/issue34155