The email module of Python through 3.11.3 incorrectly parses e-mail addresses that…
Priority MEDIUM 63CWE-1286Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 15 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02527 84th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 9 advisoriesRed Hat: 15 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | up to 2.7.18; 3.0 to before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.6 | Vulnerable | python-pillow |
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions up to 2.7.18; 3.0 to before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.6 Vulnerable ·python-pillow
Remediation
Red Hat 9 advisories
- RHSA-2024:3062 Released 2024-05-22 · Red Hat rating Moderatepython3.11 security update
- Red Hat Enterprise Linux AppStream (v. 8) python3.11-3.11.7-1.el8, python3.11-devel-3.11.7-1.el8, python3.11-libs-3.11.7-1.el8 +2
- Red Hat Enterprise Linux CRB (v. 8) python3.11-3.11.7-1.el8, python3.11-debug-3.11.7-1.el8, python3.11-idle-3.11.7-1.el8 +2
- RHSA-2024:2985 Released 2024-05-22 · Red Hat rating Moderatepython39:3.9 and python39-devel:3.9 security update
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9, mod_wsgi-4.7.1-7.module+el8.9.0+19644+d68f775d.src::python39:3.9, numpy-1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9 +47
- Red Hat Enterprise Linux CRB (v. 8) Cython-0.29.21-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9 +33
- RHSA-2024:2292 Released 2024-04-30 · Red Hat rating Moderatepython3.11 security update
- Red Hat Enterprise Linux AppStream (v. 9) python3.11-3.11.7-1.el9, python3.11-devel-3.11.7-1.el9, python3.11-libs-3.11.7-1.el9 +1
- Red Hat Enterprise Linux CRB (v. 9) python3.11-3.11.7-1.el9, python3.11-debug-3.11.7-1.el9, python3.11-idle-3.11.7-1.el9 +2
Show 6 more Red Hat advisories
- RHSA-2024:1383 Released 2024-03-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
- RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +23
- RHSA-2024:0586 Released 2024-01-30 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) platform-python-3.6.8-51.el8_8.4, platform-python-debug-3.6.8-51.el8_8.4, platform-python-devel-3.6.8-51.el8_8.4 +3
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) platform-python-3.6.8-51.el8_8.4, python3-3.6.8-51.el8_8.4, python3-libs-3.6.8-51.el8_8.4 +1
- RHSA-2024:0466 Released 2024-01-25 · Red Hat rating Moderatepython3.9 security update
- Red Hat CodeReady Linux Builder (v. 9) python3-3.9.18-1.el9_3.1, python3-debug-3.9.18-1.el9_3.1, python3-idle-3.9.18-1.el9_3.1 +2
- Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.18-1.el9_3.1, python3-devel-3.9.18-1.el9_3.1, python3-tkinter-3.9.18-1.el9_3.1
- Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.18-1.el9_3.1, python3-libs-3.9.18-1.el9_3.1, python3.9-3.9.18-1.el9_3.1
- RHSA-2024:0454 Released 2024-01-25 · Red Hat rating Moderatepython3.9 security update
- Red Hat CodeReady Linux Builder EUS (v.9.2) python3-3.9.16-1.el9_2.3, python3-debug-3.9.16-1.el9_2.3, python3-idle-3.9.16-1.el9_2.3 +2
- Red Hat Enterprise Linux AppStream EUS (v.9.2) python-unversioned-command-3.9.16-1.el9_2.3, python3-devel-3.9.16-1.el9_2.3, python3-tkinter-3.9.16-1.el9_2.3
- Red Hat Enterprise Linux BaseOS EUS (v.9.2) python3-3.9.16-1.el9_2.3, python3-libs-3.9.16-1.el9_2.3, python3.9-3.9.16-1.el9_2.3
- RHSA-2024:0430 Released 2024-01-25 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) platform-python-3.6.8-47.el8_6.4, platform-python-debug-3.6.8-47.el8_6.4, platform-python-devel-3.6.8-47.el8_6.4 +3
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) platform-python-3.6.8-47.el8_6.4, python3-3.6.8-47.el8_6.4, python3-libs-3.6.8-47.el8_6.4 +1
- RHSA-2024:0256 Released 2024-01-15 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-56.el8_9.3, platform-python-debug-3.6.8-56.el8_9.3, platform-python-devel-3.6.8-56.el8_9.3 +3
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-56.el8_9.3, python3-3.6.8-56.el8_9.3, python3-libs-3.6.8-56.el8_9.3 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2024:1383 |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2024:0466 |
| Red Hat CodeReady Linux Builder EUS (v.9.2) | Fixed | RHSA-2024:0454 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0256, RHSA-2024:2985, RHSA-2024:3062 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:0466, RHSA-2024:2292 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2024:0430 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:0586 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:0454 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:0256 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2024:0466 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2024:0430 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:0586 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.2) | Fixed | RHSA-2024:0454 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2024:2985, RHSA-2024:3062 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2024:2292 |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-27043
- 2026-10-03 Alias added: GHSA-5mwm-wccq-xqcp
References
Advisory 40
- http://python.org
- https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html
- https://security.netapp.com/advisory/ntap-20230601-0003/
- FEDORA-2023-88fbb78cd3
- FEDORA-2023-555b4d49b1
- FEDORA-2023-2f86a608b2
- FEDORA-2023-1bb427c240
- FEDORA-2023-87771f4249
- FEDORA-2023-c61a7d5227
- FEDORA-2023-d577604e6a
- FEDORA-2023-7d223ee343
- FEDORA-2023-c0bf8c0c4e
- FEDORA-2023-f96ff39b59
- FEDORA-2023-8085628fff
- FEDORA-2023-d01f8a69b4
- FEDORA-2023-b245e992ea
- FEDORA-2023-0583eedde7
- FEDORA-2024-06ff0a6def
- FEDORA-2024-3ab90a5b01
- FEDORA-2023-0583eedde7
- FEDORA-2024-8df4ac93d7
- FEDORA-2024-94e0390e4e
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/
Sources
- CVE-2023-27043 · CVE Program
- CVE-2023-27043 · NVD
- FIRST EPSS
- GHSA-5mwm-wccq-xqcp · GitHub Advisory Database · CC BY 4.0
- CVE-2023-27043 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences