7.5
CVSSv3

CVE-2019-16056

Published: 06/09/2019 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

An issue exists in Python up to and including 2.7.16, 3.x up to and including 3.5.7, 3.6.x up to and including 3.6.9, and 3.7.x up to and including 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

python python

fedoraproject fedora 29

fedoraproject fedora 30

fedoraproject fedora 31

debian debian linux 8.0

debian debian linux 9.0

canonical ubuntu linux 18.04

canonical ubuntu linux 19.04

canonical ubuntu linux 14.04

canonical ubuntu linux 16.04

canonical ubuntu linux 12.04

redhat software collections 1.0

oracle solaris 11

oracle peoplesoft enterprise peopletools 8.57

oracle communications operations monitor 3.4

oracle peoplesoft enterprise peopletools 8.58

oracle communications operations monitor

oracle zfs storage appliance kit 8.8

opensuse leap 15.0

opensuse leap 15.1

Vendor Advisories

Debian Bug report logs - #940901 python27: CVE-2019-16056 Package: src:python27; Maintainer for src:python27 is Matthias Klose <doko@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 21 Sep 2019 15:30:02 UTC Severity: important Tags: security, upstream Found in versions python27/271 ...
Several security issues were fixed in Python ...
An issue was discovered in Python through 2716, 3x through 357, 36x through 369, and 37x through 374 The email module wrongly parses email addresses that contain multiple @ characters An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an ema ...
Synopsis Moderate: python27-python security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for python27-python is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulner ...
Synopsis Moderate: python security update Type/Severity Security Advisory: Moderate Topic An update for python is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, whic ...
Synopsis Moderate: python3 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for python3 is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) ba ...
概要 Moderate: python security update タイプ/重大度 Security Advisory: Moderate トピック An update for python is now available for Red Hat Enterprise Linux 77 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...
Synopsis Moderate: python3 security update Type/Severity Security Advisory: Moderate Topic An update for python3 is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, wh ...
Synopsis Moderate: rh-python36-python security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for rh-python36-python is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common ...
Synopsis Moderate: python27:27 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for the python27:27 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vul ...
Synopsis Important: Container-native Virtualization security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 240 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Securi ...
Synopsis Moderate: OpenShift Container Platform 461 image security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat OpenShift Container Platform 46Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...
An issue was discovered in Python through 2716, 3x through 357, 36x through 369, and 37x through 374 The email module wrongly parses email addresses that contain multiple @ characters An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an ema ...
A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it ...

References

NVD-CWE-noinfohttps://bugs.python.org/issue34155https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9https://lists.debian.org/debian-lts-announce/2019/09/msg00019.htmlhttps://lists.debian.org/debian-lts-announce/2019/09/msg00018.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00011.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlhttps://access.redhat.com/errata/RHSA-2019:3948http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.htmlhttps://access.redhat.com/errata/RHSA-2019:3725http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.htmlhttps://usn.ubuntu.com/4151-2/https://usn.ubuntu.com/4151-1/https://security.netapp.com/advisory/ntap-20190926-0005/https://lists.debian.org/debian-lts-announce/2020/08/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ehttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940901https://usn.ubuntu.com/4151-1/https://nvd.nist.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10