TI-2025-14016 CVE-2025-15367 · GHSA-g82h-mgfp-jx8g
POP3 command injection in user-controlled commands
Priority LOW 29
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines.
RHSA-2026:5221
python3 security update
Released 2026-03-23 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.4) platform-python-3.6.8-39.el8_4.9, platform-python-debug-3.6.8-39.el8_4.9, platform-python-devel-3.6.8-39.el8_4.9 +3
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.9, platform-python-debug-3.6.8-39.el8_4.9, platform-python-devel-3.6.8-39.el8_4.9 +3
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) platform-python-3.6.8-39.el8_4.9, python3-3.6.8-39.el8_4.9, python3-libs-3.6.8-39.el8_4.9 +1
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) platform-python-3.6.8-39.el8_4.9, python3-3.6.8-39.el8_4.9, python3-libs-3.6.8-39.el8_4.9 +1
Fixes 3 records
TI-2025-14015 CVE-2025-15366 · GHSA-4c67-8q63-xrxq
IMAP command injection in user-controlled commands
Priority LOW 29
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines.
TI-2026-01014 CVE-2026-1299 · GHSA-jh94-8q48-f3m3
email BytesGenerator header injection due to unquoted newlines
Priority LOW 28
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.