gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API)#105127

tdwyer

This PR is designed to detect parsing errors and return an empty tuple to indicate the parsing error. Additionally, this PR updates the test_email.py to check for these bugs, as well as, adds some other wacky Address Headers that are in the examples of RFC 2822 and makes sure they are being parsed correctly.

I realize that this PR dose not actually track down the bug and fix it. It simply detects the error has happened and returns a parsing error. However, Lib/email/utils.py is a much simpler file than Lib/email/_parseaddr.py, so it is much easier to review this change. Additionally, there are actually multiple bugs which are causing erroneous output. Tracing the code flow for each and fixing them would be prone to error considering all of the wacky stuff that RFC 2822 allows for in Address headers. Finally, this change is actually rather simple.

Issue: [CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

… tuple to indicate the parsing error (old API)

bedevere-bot

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

tdwyer

I had to create a new PR to replace the last one because Git got all messed up.

This is the old PR: #102990

bedevere-bot

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

tdwyer

Hum... it looks like CVE-2019-16056 was only fixed for parseaddr() and not getaddresses(). This PR happens to fix that too.
https://www.cve.org/CVERecord?id=CVE-2019-16056

getaddresses()

a = ['a@b.com<z@x.com>']
getaddresses(a)
[('', 'a@b.com'), ('', 'z@x.com')]

parseaddr()

a = ['a@b.com<z@x.com>']
parseaddr(a)
('', 'a@b.com<z@x.com>')

tdwyer

Should I add that NEWS entry that the Bot is asking for?

CharlieZhao95

Should I add that NEWS entry that the Bot is asking for?

I think it is needed, NEWS entry is required for most code modifications 😄. Please see: https://devguide.python.org/core-developers/committing/#updating-news-and-what-s-new-in-python

tdwyer

I added NEWS entry, and all Unit tests have passed.

…sList

gpshead

Docs updated, auto-merge set. The backports beyond 3.12 will require manual work to get version numbered things right. I'd like to let this bake in 3.12beta4 & 3.12rc1 for a while first to see if any practical issues arise before landing the backports in older releases.

it is a security issue so we could backport it all the way to 3.8, but lets see how things go first. it is not high severity.

miss-islington

Thanks @tdwyer for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12.
🐍🍒⛏🤖

miss-islington

Sorry, @tdwyer and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 18dfbd035775c15533d13a98e56b1d2bf5c65f00 3.11

… tuple to indicate the parsing error (old API) (pythonGH-105127) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least ameliorates CVE-2023-27043. --------- (cherry picked from commit 18dfbd0) Co-authored-by: Thomas Dwyer <github@tomd.tel> Co-authored-by: Gregory P. Smith <greg@krypto.org>

miss-islington

Sorry @tdwyer and @gpshead, I had trouble checking out the 3.10 backport branch.
Please retry by removing and re-adding the "needs backport to 3.10" label.
Alternatively, you can backport using cherry_picker on the command line.
cherry_picker 18dfbd035775c15533d13a98e56b1d2bf5c65f00 3.10

bedevere-bot

GH-106612 is a backport of this pull request to the 3.12 branch.

…y tuple to indicate the parsing error (old API) (GH-105127) (#106612) gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) (GH-105127) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least ameliorates CVE-2023-27043. --------- (cherry picked from commit 18dfbd0) Co-authored-by: Thomas Dwyer <github@tomd.tel> Co-authored-by: Gregory P. Smith <greg@krypto.org>

tdwyer-wish

Hello @gpshead Are you going to take care of the backports/cherrypick for 3.10 and 3.11 I'd do them but I've never done that before... Hum, actually I don't think I have permission to do that.

gpshead

i'll do them, the issue remains assigned to me as a reminder. (anyone can do it, it's just a matter of creating your PR as a fork of the relevant release branch and selecting the matching base branch in the github ui at pr creation time)

CharlieZhao95

Hello @gpshead Are you going to take care of the backports/cherrypick for 3.10 and 3.11 I'd do them but I've never done that before... Hum, actually I don't think I have permission to do that.

Please see https://devguide.python.org/core-developers/committing/#backporting-changes-to-an-older-version for details.

gpshead

this appears to have caused #106669

…g errors and return empty tuple to indicate the parsing error (old API) (python#105127)" This reverts commit 18dfbd0. See python#106669.

…#105127)" (#106733) This reverts commit 18dfbd0. Adds a regression test from the issue. See #106669.

… parsing errors ... (pythonGH-105127)" (pythonGH-106733) This reverts commit 18dfbd0. Adds a regression test from the issue. See python#106669.. (cherry picked from commit a31dea1) Co-authored-by: Gregory P. Smith <greg@krypto.org>

…ors ... (GH-105127)" (GH-106733) (#106941) This reverts commit 18dfbd0. Adds a regression test from the issue. See #106669.. (cherry picked from commit a31dea1)

serhiy-storchaka

Reminder about backporting. @tdwyer @gpshead

encukou

This change was rolled back in 3.12+ in #106669.
The fixed version, #111116, was backported to 3.8+.

pythongh-102988: Detect email address parsing errors and return empty… …

81098ed

… tuple to indicate the parsing error (old API)

tdwyer requested a review from a team as a code owner May 31, 2023 02:07

bedevere-bot added the awaiting review label May 31, 2023

bedevere-bot mentioned this pull request May 31, 2023

[CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

Closed

tdwyer mentioned this pull request May 31, 2023

gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #102990

Closed

tdwyer changed the title ~~gh-102988: Detect email address parsing errors and return empty tupleto indicate the parsing error (old API)~~ May 31, 2023

r-prefix strs with \ in the tests

ecbb31c

reword getaddresses docstring

d8d2831

This comment was marked as duplicate.

Sign in to view

gpshead reviewed May 31, 2023

View reviewed changes

CharlieZhao95 reviewed Jun 6, 2023

View reviewed changes

Update comment for getaddresses() and fix broken email test

b44a0b7

This comment was marked as duplicate.

Sign in to view

Add NEWS

40002d9

tdwyer requested review from CharlieZhao95 and gpshead June 17, 2023 19:05

This comment was marked as resolved.

Sign in to view

Merge branch 'main' into fix_issues102988

86ffb57

This comment was marked as resolved.

Sign in to view

Fix NEWS entry. It was not a Module its Class email._parseaddr.Addres… …

302ee76

…sList

This comment was marked as spam.

Sign in to view

gpshead added the type-security A security issue label Jul 10, 2023

gpshead approved these changes Jul 10, 2023

View reviewed changes

bedevere-bot added awaiting merge and removed awaiting review labels Jul 10, 2023

gpshead enabled auto-merge (squash) July 10, 2023 22:49

gpshead merged commit 18dfbd0 into python:main Jul 10, 2023

bedevere-bot removed the awaiting merge label Jul 10, 2023

bedevere-bot removed the needs backport to 3.12 only security fixes label Jul 10, 2023

mcepl reviewed Jul 13, 2023

View reviewed changes

gpshead mentioned this pull request Jul 14, 2023

gh-106669: Revert "gh-102988: Detect email address parsing errors ... (#105127)" #106733

Merged

gpshead added a commit that referenced this pull request Jul 21, 2023

gh-106669: Revert "gh-102988: Detect email address parsing errors ... (… …

a31dea1

…#105127)" (#106733) This reverts commit 18dfbd0. Adds a regression test from the issue. See #106669.

gpshead mentioned this pull request Dec 14, 2023

[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() #111116

Merged

smoser mentioned this pull request Feb 26, 2024

python-3.11 - cherry pick upstream patch for CVE-2023-27043 wolfi-dev/os#13586

Merged

encukou removed needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Aug 15, 2025

Conversation

tdwyer commented May 31, 2023 • edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-bot commented May 31, 2023

Uh oh!

tdwyer commented May 31, 2023

Uh oh!

bedevere-bot commented May 31, 2023

Uh oh!

This comment was marked as duplicate.

This comment was marked as duplicate.

tdwyer commented Jun 7, 2023

Uh oh!

tdwyer commented Jun 7, 2023

Uh oh!

CharlieZhao95 commented Jun 7, 2023

Uh oh!

tdwyer commented Jun 14, 2023

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as spam.

gpshead commented Jul 10, 2023

Uh oh!

miss-islington commented Jul 10, 2023

Uh oh!

miss-islington commented Jul 10, 2023

Uh oh!

miss-islington commented Jul 10, 2023

Uh oh!

bedevere-bot commented Jul 10, 2023

Uh oh!

tdwyer-wish commented Jul 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gpshead commented Jul 12, 2023

Uh oh!

CharlieZhao95 commented Jul 12, 2023

Uh oh!

gpshead commented Jul 12, 2023

Uh oh!

serhiy-storchaka commented Aug 14, 2025

Uh oh!

encukou commented Aug 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

tdwyer commented May 31, 2023 •

edited by bedevere-bot

Loading

tdwyer-wish commented Jul 12, 2023 •

edited

Loading