TI-2025-14016 CVE-2025-15367 · GHSA-g82h-mgfp-jx8g
POP3 command injection in user-controlled commands
Priority LOW 29
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines.
RHSA-2026:6008
python3 security update
Released 2026-03-30 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.8.8) platform-python-3.6.8-51.el8_8.13, platform-python-debug-3.6.8-51.el8_8.13, platform-python-devel-3.6.8-51.el8_8.13 +3
- Red Hat Enterprise Linux AppStream TUS (v.8.8) platform-python-3.6.8-51.el8_8.13, platform-python-debug-3.6.8-51.el8_8.13, platform-python-devel-3.6.8-51.el8_8.13 +3
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) platform-python-3.6.8-51.el8_8.13, python3-3.6.8-51.el8_8.13, python3-libs-3.6.8-51.el8_8.13 +1
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) platform-python-3.6.8-51.el8_8.13, python3-3.6.8-51.el8_8.13, python3-libs-3.6.8-51.el8_8.13 +1
Fixes 3 records
TI-2025-14015 CVE-2025-15366 · GHSA-4c67-8q63-xrxq
IMAP command injection in user-controlled commands
Priority LOW 29
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines.
TI-2026-01014 CVE-2026-1299 · GHSA-jh94-8q48-f3m3
email BytesGenerator header injection due to unquoted newlines
Priority LOW 28
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.