CVE-2019-16056: Input Validation
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.
Other sources
Python could allow a remote attacker to bypass security restrictions, caused by an issue with email module incorrectly parsing email address containing multiple @ characters. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass email filtering protection.
— IBM
Python module email wrongly parses email addresses that contain multiple "@" character. An application that uses the email module and implements some kind of checks on the From/To headers of an email could be tricked into accepting an email address that should be denied.
Upstream issue: https://bugs.python.org/issue34155
Upstream patches: https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9 [master branch] https://github.com/python/cpython/commit/217077440a6938a0b428f67cfef6e053c4f8673c [3.8] https://github.com/python/cpython/commit/c48d606adcef395e59fd555496c42203b01dd3e8 [3.7] https://github.com/python/cpython/commit/13a19139b5e76175bc95294d54afc9425e4f36c9 [3.6]
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 0:2.7.5-88.el7 - Upgrade
Upgrade
redhat/python3to a version that resolves this vulnerability.Fixed in 0:3.6.8-13.el7 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 0:2.7.5-87.el7_7 - Upgrade
Upgrade
redhat/python3to a version that resolves this vulnerability.Fixed in 0:3.6.8-23.el8 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.9-2.el6 - Upgrade
Upgrade
redhat/python27-pythonto a version that resolves this vulnerability.Fixed in 0:2.7.17-2.el6 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.9-2.el7 - Upgrade
Upgrade
redhat/python27-pythonto a version that resolves this vulnerability.Fixed in 0:2.7.17-2.el7 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 3.7.5 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 2.7.17 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Patch 13a19139b5e76175bc95294d54afc9425e4f36c9 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Patch 217077440a6938a0b428f67cfef6e053c4f8673 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Patch 8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Patch c48d606adcef395e59fd555496c42203b01dd3e8
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-16056?
CVE-2019-16056 is classified as a moderate severity vulnerability due to improper parsing of email addresses.
How do I fix CVE-2019-16056?
To fix CVE-2019-16056, upgrade to Python versions 2.7.18, 3.6.10, 3.7.5 or later.
Which versions of Python are affected by CVE-2019-16056?
CVE-2019-16056 affects Python versions up to 2.7.16 and 3.x through 3.7.4.
What components are impacted by CVE-2019-16056?
The email module in Python is specifically impacted by CVE-2019-16056.
Is CVE-2019-16056 exploitable in any specific applications?
Yes, applications that use the email module and perform checks on From/To headers may be vulnerable to exploitation.