Yüksek CVSS 7.5

CVE-2019-16056: Python: hatalı girdi doğrulama

Yayın: 6 Eylül 2019 21:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: %5,12 (yüzdelik 92)
CWE: CWE-20
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	—	2.7.16	—
python-python	3.0.0	3.0.1	—
python-python	3.1.0	3.1.5	—
python-python	3.2.0	3.2.6	—
python-python	3.3.0	3.3.7	—
python-python	3.4.0	3.4.10	—
python-python	3.5.0	3.5.7	—
python-python	3.6.0	3.6.9	—
python-python	3.7.0	3.7.4	—
fedoraproject-fedora	29	29	—
fedoraproject-fedora	30	30	—
fedoraproject-fedora	31	31	—
debian-debian-linux	8.0	8.0	—
debian-debian-linux	9.0	9.0	—
canonical-ubuntu-linux	12.04	12.04	—
canonical-ubuntu-linux	14.04	14.04	—
canonical-ubuntu-linux	16.04	16.04	—
canonical-ubuntu-linux	18.04	18.04	—
canonical-ubuntu-linux	19.04	19.04	—
redhat-software-collections	1.0	1.0	—
oracle-communications-operations-monitor	4.1	4.3	—
oracle-communications-operations-monitor	3.4	3.4	—
oracle-peoplesoft-enterprise-peopletools	8.57	8.57	—
oracle-peoplesoft-enterprise-peopletools	8.58	8.58	—
oracle-zfs-storage-appliance-kit	8.8	8.8	—
oracle-solaris	11	11	—
opensuse-leap	15.0	15.0	—
opensuse-leap	15.1	15.1	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları