CVE-2024-6923 Email header injection due to unquoted newlines

2024-08-0113:40:11

PSF

www.cve.org

cpython

email headers

injection

EPSS

Percentile

13.7%

JSON

There is a MEDIUM severity vulnerability affecting CPython.

The
email module didn’t properly quote newlines for email headers when
serializing an email message allowing for header injection when an email
is serialized.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "email"
    ],
    "product": "CPython",
    "vendor": "Python Software Foundation",
    "versions": [
      {
        "version": "0",
        "lessThan": "3.8.20",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.9.0",
        "lessThan": "3.9.20",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.10.0",
        "lessThan": "3.10.15",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.11.0",
        "lessThan": "3.11.10",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.12.0",
        "lessThan": "3.12.5",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.13.0a1",
        "lessThan": "3.13.0rc2",
        "status": "affected",
        "versionType": "python"
      }
    ]
  }
]