[3.11] [CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() (GH-111116) by encukou · Pull Request #123767 · python/cpython

encukou

Merged

ambv

merged 1 commit into

python:3.11from

encukou:backport-4a153a1-3.11

Sep 6, 2024

Merged

[3.11] [CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() (GH-111116)#123767
ambv
merged 1 commit into
python:3.11from
encukou:backport-4a153a1-3.11

Conversation

encukou commented
Sep 6, 2024
•

edited by github-actions Bot

Loading

Copy link

Copy Markdown

Member

Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer.

(cherry picked from commit 4a153a1)

Issue: [CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

📚 Documentation preview 📚: https://cpython-previews--123767.org.readthedocs.build/

[3.11] [CVE-2023-27043] pythongh-102988: Reject malformed addresses i…

067fc2e

…n email.parseaddr() (pythonGH-111116)

Detect email address parsing errors and return empty tuple to
indicate the parsing error (old API). Add an optional 'strict'
parameter to getaddresses() and parseaddr() functions. Patch by
Thomas Dwyer.

(cherry picked from commit 4a153a1)

Co-authored-by: Victor Stinner <vstinner@python.org>
Co-Authored-By: Thomas Dwyer <github@tomd.tel>

encukou requested a review from a team as a code owner