Is CVE-2023-27043 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-27043 being exploited in the wild.

How severe is CVE-2023-27043?

Medium severity, with a CVSS score of 5.3, published 19 April 2023.

Which products and versions are affected?

Python Software Foundation Python through 3.11.3.

Is there a fix for CVE-2023-27043?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2023-27043 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-27043?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-27043: Python email module incorrect parsing in email.utils.parseaddr

CVE-2023-27043 · Severity: medium · CVSS 5.3 · Published 2023-04-19

A vulnerability in the Python programming language's email handling library can cause it to incorrectly identify the sender of an email. This flaw allows an attacker to bypass security checks that rely on email domain verification, such as systems that only allow signups from specific corporate or government email addresses. In practice, this could lead to unauthorized account creation or access to restricted services.

Quick answers

Is CVE-2023-27043 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-27043 being exploited in the wild.
How severe is CVE-2023-27043?: Medium severity, with a CVSS score of 5.3, published 19 April 2023.
Which products and versions are affected?: Python Software Foundation Python through 3.11.3.
Is there a fix for CVE-2023-27043?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-27043 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-27043?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw exists in the email.utils.parseaddr() and email.utils.getaddresses() functions within the email/_parseaddr.py component. When an RFC 2822 header contains specific special characters, the parser may incorrectly identify the 'Real Name' portion of the header as the 'addr-spec' (the actual email address). An attacker can exploit this by crafting a malicious email header that tricks an application into validating a trusted domain while the actual delivery or underlying logic uses a different, attacker-controlled address. This is classified as Improper Validation of Syntactic Correctness of Input (CWE-1286).

Affected products

Python Software Foundation Python through 3.11.3

Timeline

2023-03-24: disclosed: Issue reported on GitHub cpython repository
2023-04-19: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.