[3.10] [CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() (GH-111116) by encukou · Pull Request #123768 · python/cpython

encukou

Merged

ambv

merged 2 commits into

python:3.10from

encukou:backport-4a153a1-3.10

Sep 6, 2024

Merged

[3.10] [CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() (GH-111116)#123768
ambv
merged 2 commits into
python:3.10from
encukou:backport-4a153a1-3.10

Conversation

encukou commented
Sep 6, 2024
•

edited by bedevere-app Bot

Loading

Copy link

Copy Markdown

Member

Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer.

(cherry picked from commit 4a153a1)

Issue: [CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

[3.10] [CVE-2023-27043] pythongh-102988: Reject malformed addresses i…

734cb2f

…n email.parseaddr() (pythonGH-111116)

Detect email address parsing errors and return empty tuple to
indicate the parsing error (old API). Add an optional 'strict'
parameter to getaddresses() and parseaddr() functions. Patch by
Thomas Dwyer.

(cherry picked from commit 4a153a1)

Co-authored-by: Victor Stinner <vstinner@python.org>
Co-Authored-By: Thomas Dwyer <github@tomd.tel>

encukou requested a review from a team as a code owner