https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 03:51:47 +0000 https://vulnerability.circl.lu/vuln/cve-2023-27043 <p><strong>Affected:</strong> Siemens RUGGEDCOM ROX MX5000, Siemens RUGGEDCOM ROX MX5000RE, Siemens RUGGEDCOM ROX RX1400, Siemens RUGGEDCOM ROX RX1500, Siemens RUGGEDCOM ROX RX1501, Siemens RUGGEDCOM ROX RX1510, Siemens RUGGEDCOM ROX RX1511, Siemens RUGGEDCOM ROX RX1512, Siemens RUGGEDCOM ROX RX1524, Siemens RUGGEDCOM ROX RX1536 and 1 more</p> <p>The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.</p> <p><strong>Affected:</strong> Siemens RUGGEDCOM ROX MX5000, Siemens RUGGEDCOM ROX MX5000RE, Siemens RUGGEDCOM ROX RX1400, Siemens RUGGEDCOM ROX RX1500, Siemens RUGGEDCOM ROX RX1501, Siemens RUGGEDCOM ROX RX1510, Siemens RUGGEDCOM ROX RX1511, Siemens RUGGEDCOM ROX RX1512, Siemens RUGGEDCOM ROX RX1524, Siemens RUGGEDCOM ROX RX1536 and 1 more</p> <p>The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.</p> https://vulnerability.circl.lu/vuln/cve-2023-27043 https://vulnerability.circl.lu/vuln/usn-7015-1 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: python3.8, Ubuntu:22.04:LTS: python3.10, Ubuntu:24.04:LTS: python3.12</p> <p>It was discovered that the Python email module incorrectly parsed email addresses that contain special characters. A remote attacker could possibly use this issue to bypass certain protection mechanisms. (CVE-2023-27043)</p> <p>It was discovered that Python allowed excessive backtracking while parsing certain tarfile headers. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. (CVE-2024-6232)</p> <p>It was discovered that the Python email module incorrectly quoted newlines for email headers. A remote attacker could possibly use this issue to perform header injection. (CVE-2024-6923)</p> <p>It was discovered that the Python http.cookies module incorrectly handled parsing cookies that contained backslashes for quoted characters. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. (CVE-2024-7592)</p> <p>It was discovered that the Python zipfile module incorrectly handled certain malformed zip files. A remote attacker could possibly use this issue to cause Python to stop responding, resulting in a denial of service. (CVE-2024-8088)</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: python3.8, Ubuntu:22.04:LTS: python3.10, Ubuntu:24.04:LTS: python3.12</p> <p>It was discovered that the Python email module incorrectly parsed email addresses that contain special characters. A remote attacker could possibly use this issue to bypass certain protection mechanisms. (CVE-2023-27043)</p> <p>It was discovered that Python allowed excessive backtracking while parsing certain tarfile headers. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. (CVE-2024-6232)</p> <p>It was discovered that the Python email module incorrectly quoted newlines for email headers. A remote attacker could possibly use this issue to perform header injection. (CVE-2024-6923)</p> <p>It was discovered that the Python http.cookies module incorrectly handled parsing cookies that contained backslashes for quoted characters. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. (CVE-2024-7592)</p> <p>It was discovered that the Python zipfile module incorrectly handled certain malformed zip files. A remote attacker could possibly use this issue to cause Python to stop responding, resulting in a denial of service. (CVE-2024-8088)</p> https://vulnerability.circl.lu/vuln/usn-7015-1