Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-5mwm-wccq-xqcp

Опубликовано: 19 апр. 2023
Источник: github
Github: Не прошло ревью
CVSS3: 5.3

Описание

The e-mail module of Python 0 - 2.7.18, 3.x - 3.11 incorrectly parses e-mail addresses which contain a special character. This vulnerability allows attackers to send messages from e-ail addresses that would otherwise be rejected.

The e-mail module of Python 0 - 2.7.18, 3.x - 3.11 incorrectly parses e-mail addresses which contain a special character. This vulnerability allows attackers to send messages from e-ail addresses that would otherwise be rejected.

EPSS

Процентиль: 31%
0.00115
Низкий

5.3 Medium

CVSS3

Дефекты

CWE-20

Связанные уязвимости

CVSS3: 5.3
ubuntu
около 2 лет назад

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

CVSS3: 5.3
redhat
около 2 лет назад

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

CVSS3: 5.3
nvd
около 2 лет назад

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

CVSS3: 5.3
msrc
5 месяцев назад

Описание отсутствует

CVSS3: 5.3
debian
около 2 лет назад

The email module of Python through 3.11.3 incorrectly parses e-mail ad ...

EPSS

Процентиль: 31%
0.00115
Низкий

5.3 Medium

CVSS3

Дефекты

CWE-20