CVE-2024-6923: Email header injection due to unquoted newlines

Medium severity · published Aug 1, 2024

CVE-2024-6923

Email header injection due to unquoted newlines

5.5

CVSS

1.1%

EPSS

On KEV

Description

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.1% · higher than 66% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CPython · Python Software Foundation

before 3.8.20; 3.9.0 before 3.9.20; 3.10.0 before 3.10.15; 3.11.0 before 3.11.10; 3.12.0 before 3.12.5; 3.13.0a1 before 3.13.0rc2 · source: vendor, CISA

Affected product

CPython

Python Software Foundation

All CPython CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-6923

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-6923

github.com

https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147

github.com