python2.7: CVE-2019-16056

Debian Bug report logs - #940901
python2.7: CVE-2019-16056

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: python2.7: CVE-2019-16056

Date: Sat, 21 Sep 2019 17:26:25 +0200

Source: python2.7
Version: 2.7.16-4
Severity: important
Tags: security upstream
Forwarded: https://bugs.python.org/issue34155
Control: found -1 2.7.16-2
Control: found -1 2.7.13-2+deb9u3
Control: found -1 2.7.13-2

Hi,

The following vulnerability was published for python2.7.

CVE-2019-16056[0]:
| An issue was discovered in Python through 2.7.16, 3.x through 3.5.7,
| 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly
| parses email addresses that contain multiple @ characters. An
| application that uses the email module and implements some kind of
| checks on the From/To headers of a message could be tricked into
| accepting an email address that should be denied. An attack may be the
| same as in CVE-2019-11340; however, this CVE applies to Python more
| generally.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-16056
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056
[1] https://bugs.python.org/issue34155
[2] https://github.com/python/cpython/commit/4cbcd2f8c4e12b912e4d21fd892eedf7a3813d8e

Regards,
Salvatore

Send a report that this bug log contains spam.