CVE-2023-27043 : The email module of Python through 3.11.3 incorrectly parses e-mail addresses th

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Published 2023-04-19 00:15:08

Updated 2024-02-26 16:27:46

Source MITRE

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2023-27043

Python » Python
Versions up to, including, (<=) 2.7.18
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Matching versions
Python » Python
Versions from including (>=) 3.0 and up to, including, (<=) 3.11
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2023-27043

Top countries where our scanners detected CVE-2023-27043

Top open port discovered on systems with this issue 80

IPs affected by CVE-2023-27043 420,807

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2023-27043!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2023-27043

EPSS FAQ

0.20%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 59 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-27043

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2023-27043

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-27043

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/

[SECURITY] Fedora 39 Update: python3.8-3.8.18-3.fc39 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/

[SECURITY] Fedora 39 Update: python3.7-3.7.17-4.fc39 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/

[SECURITY] Fedora 39 Update: python3.11-3.11.7-2.fc39 - package-announce - Fedora Mailing-Lists
https://security.netapp.com/advisory/ntap-20230601-0003/

CVE-2023-27043 Python Vulnerability in NetApp Products | NetApp Product Security
http://python.org

Welcome to Python.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/

[SECURITY] Fedora 38 Update: python3.6-3.6.15-22.fc38 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/

[SECURITY] Fedora 38 Update: mingw-python3-3.11.8-1.fc38 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/

[SECURITY] Fedora 39 Update: python3.10-3.10.13-2.fc39 - package-announce - Fedora Mailing-Lists
https://github.com/python/cpython/issues/102988

Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple · Issue #102988 · python/cpython · GitHub
Exploit;Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/

[SECURITY] Fedora 39 Update: mingw-python3-3.11.8-1.fc39 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/

[SECURITY] Fedora 38 Update: python3-docs-3.11.7-1.fc38 - package-announce - Fedora Mailing-Lists
https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html

Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple — Python Security 0.0 documentation
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/

[SECURITY] Fedora 39 Update: python3.6-3.6.15-22.fc39 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/

[SECURITY] Fedora 39 Update: python3.9-3.9.18-3.fc39 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/

[SECURITY] Fedora 38 Update: python3.9-3.9.18-3.fc38 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/

[SECURITY] Fedora 39 Update: python2.7-2.7.18-37.fc39 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/

[SECURITY] Fedora 38 Update: python3.7-3.7.17-4.fc38 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/

[SECURITY] Fedora 38 Update: python3.10-3.10.13-2.fc38 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/

[SECURITY] Fedora 38 Update: python3.8-3.8.18-3.fc38 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/

[SECURITY] Fedora 38 Update: python3.11-3.11.7-2.fc38 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/

[SECURITY] Fedora 38 Update: python2.7-2.7.18-37.fc38 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/

[SECURITY] Fedora 38 Update: python3.12-3.12.1-2.fc38 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/

[SECURITY] Fedora 39 Update: python3.12-3.12.1-2.fc39 - package-announce - Fedora Mailing-Lists