Miggo Logo

CVE-2023-27043:
The e-mail module of Python 0 - 2.7.18, 3.x - 3.11 incorrectly parses e-mail addresses which...

5.3

CVSS Score
3.1

Basic Information

EPSS Score
0.31053%
Published
4/19/2023
Updated
3/5/2024
KEV Status
No
Technology
-

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability CVE-2023-27043 concerns incorrect parsing of email addresses with special characters in Python's email module. The provided issue description (https://github.com/python/cpython/issues/102988) explicitly mentions email.utils.parseaddr() and email.utils.getaddresses() as the affected functions. The commit d45802b6148287204173adde40f787dda28e18c9 directly modifies these two functions in Lib/email/utils.py by adding validation logic (_pre_parse_validation and _post_parse_validation) around the call to _AddressList (which is email._parseaddr.AddressList). This indicates that these public-facing functions were the entry points for the vulnerability, as they previously returned the potentially misparsed results from _AddressList without adequate checks. The vulnerability was that these functions could be tricked into returning the 'real name' part of an address as the 'email address' part. The patches ensure that the output is validated before being returned, thus fixing the vulnerability within these functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** *-m*il mo*ul* o* Pyt*on * - *.*.**, *.x - *.** in*orr**tly p*rs*s *-m*il ***r*ss*s w*i** *ont*in * sp**i*l ***r**t*r. T*is vuln*r**ility *llows *tt**k*rs to s*n* m*ss***s *rom *-*il ***r*ss*s t**t woul* ot**rwis* ** r*j**t**.

Reasoning

T** vuln*r**ility *V*-****-***** *on**rns in*orr**t p*rsin* o* *m*il ***r*ss*s wit* sp**i*l ***r**t*rs in Pyt*on's `*m*il` mo*ul*. T** provi*** issu* **s*ription (*ttps://*it*u*.*om/pyt*on/*pyt*on/issu*s/******) *xpli*itly m*ntions `*m*il.utils.p*rs*