CVE-2024-6923: Email header injection due to unquoted newlines
Email header injection due to unquoted newlines
Other sources
Python CPython is vulnerable to email header injection, caused by the failure to properly quote newlines for email headers when serializing an email message. By persuading a victim to open a specially crafted email, a remote authenticated attacker could exploit this vulnerability to spoof sender identity, gain unauthorized email sending or loss of control over email communication.
— IBM
There is a MEDIUM severity vulnerability affecting CPython.
The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
— Red Hat
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6923?
CVE-2024-6923 is considered a medium severity vulnerability due to the potential for email header injection.
How do I fix CVE-2024-6923?
To fix CVE-2024-6923, update affected versions of Python packages to the latest version that addresses this vulnerability.
Which versions of Python are affected by CVE-2024-6923?
CVE-2024-6923 affects Python 2.7 up to 2.7.18-8+deb11u1 and various versions of Python 3 including 3.11.2-6+deb12u3.
Can CVE-2024-6923 be exploited remotely?
Yes, CVE-2024-6923 can be exploited remotely by an authenticated attacker through specially crafted email messages.
What is the impact of CVE-2024-6923 on software security?
The impact of CVE-2024-6923 can lead to unauthorized actions or access due to improper handling of email headers.