CVE-2019-16056: Input Validation
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.
Other sources
Python could allow a remote attacker to bypass security restrictions, caused by an issue with email module incorrectly parsing email address containing multiple @ characters. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass email filtering protection.
— IBM
Python module email wrongly parses email addresses that contain multiple "@" character. An application that uses the email module and implements some kind of checks on the From/To headers of an email could be tricked into accepting an email address that should be denied.
Upstream issue: https://bugs.python.org/issue34155
Upstream patches: https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9 [master branch] https://github.com/python/cpython/commit/217077440a6938a0b428f67cfef6e053c4f8673c [3.8] https://github.com/python/cpython/commit/c48d606adcef395e59fd555496c42203b01dd3e8 [3.7] https://github.com/python/cpython/commit/13a19139b5e76175bc95294d54afc9425e4f36c9 [3.6]
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-16056?
CVE-2019-16056 is classified as a moderate severity vulnerability due to improper parsing of email addresses.
How do I fix CVE-2019-16056?
To fix CVE-2019-16056, upgrade to Python versions 2.7.18, 3.6.10, 3.7.5 or later.
Which versions of Python are affected by CVE-2019-16056?
CVE-2019-16056 affects Python versions up to 2.7.16 and 3.x through 3.7.4.
What components are impacted by CVE-2019-16056?
The email module in Python is specifically impacted by CVE-2019-16056.
Is CVE-2019-16056 exploitable in any specific applications?
Yes, applications that use the email module and perform checks on From/To headers may be vulnerable to exploitation.