CVE-2024-6923

Name
CVE-2024-6923
Description
There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
patch https://github.com/python/cpython/pull/122233
issue-tracking https://github.com/python/cpython/issues/121650
vendor-advisory https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/
patch https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7
patch https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0
patch https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147
patch https://github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1
patch https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6
patch https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533
af854a3a-2127-422b-91ae-364da2661108 http://www.openwall.com/lists/oss-security/2024/08/01/3
af854a3a-2127-422b-91ae-364da2661108 http://www.openwall.com/lists/oss-security/2024/08/02/2
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2025/01/msg00005.html
af854a3a-2127-422b-91ae-364da2661108 https://security.netapp.com/advisory/ntap-20240926-0003/
cna@python.org https://github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html

Match rules

CPE URI Source package Min version Max version
cpython >= 0 < 3.8.20
cpython >= 3.9.0 < 3.9.20
cpython >= 3.10.0 < 3.10.15
cpython >= 3.11.0 < 3.11.10
cpython >= 3.12.0 < 3.12.5
cpython >= 3.13.0a1 < 3.13.0rc2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
python3 edge-main 3.12.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.22-main 3.12.5-r0 None fixed
python3 3.21-main 3.12.5-r0 None fixed
python3 3.20-main 3.12.6-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.19-main 3.11.10-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.18-main 3.11.10-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.17-main 3.10.15-r0 Natanael Copa <ncopa@alpinelinux.org> fixed