CVE-2023-27043:
The e-mail module of Python 0 - 2.7.18, 3.x - 3.11 incorrectly parses e-mail addresses which...
5.3
Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability CVE-2023-27043 concerns incorrect parsing of email addresses with special characters in Python's email
module. The provided issue description (https://github.com/python/cpython/issues/102988) explicitly mentions email.utils.parseaddr()
and email.utils.getaddresses()
as the affected functions. The commit d45802b6148287204173adde40f787dda28e18c9
directly modifies these two functions in Lib/email/utils.py
by adding validation logic (_pre_parse_validation
and _post_parse_validation
) around the call to _AddressList
(which is email._parseaddr.AddressList
). This indicates that these public-facing functions were the entry points for the vulnerability, as they previously returned the potentially misparsed results from _AddressList
without adequate checks. The vulnerability was that these functions could be tricked into returning the 'real name' part of an address as the 'email address' part. The patches ensure that the output is validated before being returned, thus fixing the vulnerability within these functions.