IM
IronMonkey Threat Research

CVE-2019-16056 HIGH

Published: 2019-09-06 | Last Modified: 2026-10-07 | Status: Modified

Description

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Additional Descriptions (1)

Se descubrió un problema en Python versiones hasta 2.7.16, versiones 3.x hasta 3.5.7, versiones 3.6.x hasta 3.6.9 y versiones 3.7.x hasta 3.7.4. El módulo de correo electrónico analiza incorrectamente las direcciones de correo electrónico que contienen múltiples caracteres @. Una aplicación que usa el módulo de correo electrónico e implementa algún tipo de comprobación sobre los encabezados From/To de un mensaje podría ser engañada para aceptar una dirección de correo electrónico que debería ser denegada. Un ataque puede ser el mismo que en CVE-2019-11340; sin embargo, este CVE aplica a Python de manera más general.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en NVD-CWE-noinfo
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-20

Affected Products

Vendor Product Version Update Type
python python * <built-in method update of dict object at 0x7fd36b156040> Application
python python * <built-in method update of dict object at 0x7fd384aa3d80> Application
python python * <built-in method update of dict object at 0x7fd36a7399c0> Application
python python * <built-in method update of dict object at 0x7fd341257240> Application
python python * <built-in method update of dict object at 0x7fd36b157600> Application
python python * <built-in method update of dict object at 0x7fd36b1544c0> Application
python python * <built-in method update of dict object at 0x7fd319c76c80> Application
python python * <built-in method update of dict object at 0x7fd34bce3d80> Application
python python * <built-in method update of dict object at 0x7fd369406c80> Application
fedoraproject fedora 29 <built-in method update of dict object at 0x7fd36b157440> Operating System
fedoraproject fedora 30 <built-in method update of dict object at 0x7fd319dd6440> Operating System
fedoraproject fedora 31 <built-in method update of dict object at 0x7fd34bce12c0> Operating System
debian debian_linux 8.0 <built-in method update of dict object at 0x7fd36a738780> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd3844a04c0> Operating System
canonical ubuntu_linux 12.04 <built-in method update of dict object at 0x7fd34bce3980> Operating System
canonical ubuntu_linux 14.04 <built-in method update of dict object at 0x7fd36a73a480> Operating System
canonical ubuntu_linux 16.04 <built-in method update of dict object at 0x7fd384aa2b00> Operating System
canonical ubuntu_linux 18.04 <built-in method update of dict object at 0x7fd34bce0740> Operating System
canonical ubuntu_linux 19.04 <built-in method update of dict object at 0x7fd36a738200> Operating System
redhat software_collections 1.0 <built-in method update of dict object at 0x7fd34bce3080> Application
oracle communications_operations_monitor * <built-in method update of dict object at 0x7fd34bce0f40> Application
oracle communications_operations_monitor 3.4 <built-in method update of dict object at 0x7fd34bce0b00> Application
oracle peoplesoft_enterprise_peopletools 8.57 <built-in method update of dict object at 0x7fd36a739640> Application
oracle peoplesoft_enterprise_peopletools 8.58 <built-in method update of dict object at 0x7fd341257380> Application
oracle zfs_storage_appliance_kit 8.8 <built-in method update of dict object at 0x7fd2a2df8a00> Application
oracle solaris 11 <built-in method update of dict object at 0x7fd384a659c0> Operating System
opensuse leap 15.0 <built-in method update of dict object at 0x7fd348dadac0> Operating System
opensuse leap 15.1 <built-in method update of dict object at 0x7fd36a738a80> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
Yes cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

References