Junglewise Threat Intelligence

CVE-2023-27043: Python email module incorrect parsing in email.utils.parseaddr

CVE-2023-27043 · Severity: medium · CVSS 5.3 · Published 2023-04-19

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Executive brief

A vulnerability in the Python programming language's email handling library can cause it to incorrectly identify the sender of an email. This flaw allows an attacker to bypass security checks that rely on email domain verification, such as systems that only allow signups from specific corporate or government email addresses. In practice, this could lead to unauthorized account creation or access to restricted services.

Technical details

A flaw exists in the email.utils.parseaddr() and email.utils.getaddresses() functions within the email/_parseaddr.py component. When an RFC 2822 header contains specific special characters, the parser may incorrectly identify the 'Real Name' portion of the header as the 'addr-spec' (the actual email address). An attacker can exploit this by crafting a malicious email header that tricks an application into validating a trusted domain while the actual delivery or underlying logic uses a different, attacker-controlled address. This is classified as Improper Validation of Syntactic Correctness of Input (CWE-1286).

Affected products

  • Python Software Foundation Python through 3.11.3

Timeline

  • 2023-03-24: disclosed: Issue reported on GitHub cpython repository
  • 2023-04-19: advisory: NVD publication date

References