CVE-2019-16056: Input Validation

Published Jul 19, 2018
·
Updated

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Other sources

Python could allow a remote attacker to bypass security restrictions, caused by an issue with email module incorrectly parsing email address containing multiple @ characters. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass email filtering protection.

— IBM

Python module email wrongly parses email addresses that contain multiple "@" character. An application that uses the email module and implements some kind of checks on the From/To headers of an email could be tricked into accepting an email address that should be denied.

Upstream issue: https://bugs.python.org/issue34155

Upstream patches: https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9 [master branch] https://github.com/python/cpython/commit/217077440a6938a0b428f67cfef6e053c4f8673c [3.8] https://github.com/python/cpython/commit/c48d606adcef395e59fd555496c42203b01dd3e8 [3.7] https://github.com/python/cpython/commit/13a19139b5e76175bc95294d54afc9425e4f36c9 [3.6]

— Red Hat

Affected Software

67 affected componentsFixes available
redhat/python<0:2.7.5-88.el7
0:2.7.5-88.el7
redhat/python3<0:3.6.8-13.el7
0:3.6.8-13.el7
redhat/python<0:2.7.5-87.el7_7
0:2.7.5-87.el7_7
redhat/python3<0:3.6.8-23.el8
0:3.6.8-23.el8
redhat/rh-python36-python<0:3.6.9-2.el6
0:3.6.9-2.el6
redhat/python27-python<0:2.7.17-2.el6
0:2.7.17-2.el6
redhat/rh-python36-python<0:3.6.9-2.el7
0:3.6.9-2.el7
redhat/python27-python<0:2.7.17-2.el7
0:2.7.17-2.el7
redhat/python<3.7.5
3.7.5
redhat/python<2.7.17
2.7.17
IBM Data Risk Manager<=2.0.6
Python Python<=2.7.16
Python Python>=3.0.0<=3.0.1
Python Python>=3.1.0<=3.1.5
Python Python>=3.2.0<=3.2.6
Python Python>=3.3.0<=3.3.7
Python Python>=3.4.0<=3.4.10
Python Python>=3.5.0<=3.5.7
Python Python>=3.6.0<=3.6.9
Python Python>=3.7.0<=3.7.4
Fedoraproject Fedora=29
Fedoraproject Fedora=30
Fedoraproject Fedora=31
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.04
redhat Software Collections=1.0
Oracle Communications Operations Monitor>=4.1<=4.3
Oracle Communications Operations Monitor=3.4
Oracle PeopleSoft Enterprise PeopleTools=8.57
Oracle PeopleSoft Enterprise PeopleTools=8.58
Oracle ZFS Storage Appliance Kit=8.8
Oracle Solaris=11
openSUSE Leap=15.0
openSUSE Leap=15.1
debian/python2.7
debian/python3.4
debian/python3.5
alpine/python2<2.7.16-r3
2.7.16-r3
alpine/python2<2.7.16-r3
2.7.16-r3
alpine/python2<2.7.16-r3
2.7.16-r3
alpine/python2<2.7.16-r3
2.7.16-r3
alpine/python2<2.7.16-r3
2.7.16-r3
alpine/python2-tkinter<2.7.17-r0
2.7.17-r0
alpine/python2-tkinter<2.7.17-r0
2.7.17-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.7.5-r0
3.7.5-r0
alpine/python3<3.6.8-r1
3.6.8-r1
alpine/python3<3.6.8-r1
3.6.8-r1
alpine/python3<3.6.9-r1
3.6.9-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/python to a version that resolves this vulnerability.

    Fixed in 0:2.7.5-88.el7
  2. Upgrade

    Upgrade redhat/python3 to a version that resolves this vulnerability.

    Fixed in 0:3.6.8-13.el7
  3. Upgrade

    Upgrade redhat/python to a version that resolves this vulnerability.

    Fixed in 0:2.7.5-87.el7_7
  4. Upgrade

    Upgrade redhat/python3 to a version that resolves this vulnerability.

    Fixed in 0:3.6.8-23.el8
  5. Upgrade

    Upgrade redhat/rh-python36-python to a version that resolves this vulnerability.

    Fixed in 0:3.6.9-2.el6
  6. Upgrade

    Upgrade redhat/python27-python to a version that resolves this vulnerability.

    Fixed in 0:2.7.17-2.el6
  7. Upgrade

    Upgrade redhat/rh-python36-python to a version that resolves this vulnerability.

    Fixed in 0:3.6.9-2.el7
  8. Upgrade

    Upgrade redhat/python27-python to a version that resolves this vulnerability.

    Fixed in 0:2.7.17-2.el7
  9. Upgrade

    Upgrade redhat/python to a version that resolves this vulnerability.

    Fixed in 3.7.5
  10. Upgrade

    Upgrade redhat/python to a version that resolves this vulnerability.

    Fixed in 2.7.17
  11. Upgrade

    Upgrade alpine/python2 to a version that resolves this vulnerability.

    Fixed in 2.7.16-r3
  12. Upgrade

    Upgrade alpine/python2-tkinter to a version that resolves this vulnerability.

    Fixed in 2.7.17-r0
  13. Upgrade

    Upgrade alpine/python3 to a version that resolves this vulnerability.

    Fixed in 3.7.5-r0
  14. Upgrade

    Upgrade alpine/python3 to a version that resolves this vulnerability.

    Fixed in 3.6.8-r1
  15. Upgrade

    Upgrade alpine/python3 to a version that resolves this vulnerability.

    Fixed in 3.6.9-r1
  16. Upgrade

    Upgrade Python to a version that resolves this vulnerability.

    Patch 13a19139b5e76175bc95294d54afc9425e4f36c9
  17. Upgrade

    Upgrade Python to a version that resolves this vulnerability.

    Patch 217077440a6938a0b428f67cfef6e053c4f8673
  18. Upgrade

    Upgrade Python to a version that resolves this vulnerability.

    Patch 8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9
  19. Upgrade

    Upgrade Python to a version that resolves this vulnerability.

    Patch c48d606adcef395e59fd555496c42203b01dd3e8

Event History

Jul 19, 2018
CVE Published
12:00 AM
Sep 6, 2019
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·05:24 PM
Data Sourced
via MITRE·05:24 PM
Description
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·06:15 PM
DescriptionSeverityAffected Software
Oct 21, 2026
Data Sourced
via Microsoft·08:07 AM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2019-16056?

CVE-2019-16056 is classified as a moderate severity vulnerability due to improper parsing of email addresses.

2

How do I fix CVE-2019-16056?

To fix CVE-2019-16056, upgrade to Python versions 2.7.18, 3.6.10, 3.7.5 or later.

3

Which versions of Python are affected by CVE-2019-16056?

CVE-2019-16056 affects Python versions up to 2.7.16 and 3.x through 3.7.4.

4

What components are impacted by CVE-2019-16056?

The email module in Python is specifically impacted by CVE-2019-16056.

5

Is CVE-2019-16056 exploitable in any specific applications?

Yes, applications that use the email module and perform checks on From/To headers may be vulnerable to exploitation.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203