Input validation error in Python - CVE-2019-16056

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU22617

Input validation error in Python - CVE-2019-16056

Published: November 10, 2019


Vulnerability identifier: #VU22617
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16056
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input when processing multiple occurrences of the "@" character in an email address. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied.


Affected software

Python
Red Hat Software Collections
python (Red Hat package)
python2-tkinter (Alpine package)
python3 (Red Hat package)
python3.5-minimal (Ubuntu package)
python3.5 (Ubuntu package)
python3.7-minimal (Ubuntu package)
python3.7 (Ubuntu package)
python3.6-minimal (Ubuntu package)
python3.6 (Ubuntu package)
python3.9-minimal (Ubuntu package)
python3.9 (Ubuntu package)
python3.11 (Ubuntu package)
python3.8-minimal (Ubuntu package)
python3.11-minimal (Ubuntu package)
python3.8 (Ubuntu package)
python2-docs
python2
python34
python35
python36
python3
python38
python3.10-minimal (Ubuntu package)
python3.10 (Ubuntu package)
python3.12 (Ubuntu package)
python3.12-minimal (Ubuntu package)
Oracle Communications Operations Monitor
Data Computing Appliance (DCA)
Fedora
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Ubuntu
Opensuse

How to mitigate CVE-2019-16056

Install updates from vendor's website.

Python - addressed in versions 2.7.17, 3.5.8, 3.7.5
python (Red Hat package) - addressed in versions 2.7.5-87.el7_7, 2.7.5-88.el7
python2-tkinter (Alpine package) - update to 2.7.17-r0
Oracle Communications Operations Monitor - update to 4.3.0
python3 (Red Hat package) - addressed in versions 3.6.8-13.el7, 3.6.8-23.el8
python3.5-minimal (Ubuntu package) - update to Ubuntu Pro
python3.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3.7-minimal (Ubuntu package) - update to Ubuntu Pro
python3.7 (Ubuntu package) - update to Ubuntu Pro
python3.6-minimal (Ubuntu package) - update to Ubuntu Pro
python3.6 (Ubuntu package) - update to Ubuntu Pro
python3.9-minimal (Ubuntu package) - update to Ubuntu Pro
python3.9 (Ubuntu package) - update to Ubuntu Pro
python3.11 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.8-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.11-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.8 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python2-docs - addressed in versions 2.7.17-1.fc29, 2.7.17-1.fc30, 2.7.17-1.fc31
python2 - addressed in versions 2.7.17-1.fc29, 2.7.17-1.fc30, 2.7.17-1.fc31
python34 - addressed in versions 3.4.10-3.fc29, 3.4.10-3.fc30, 3.4.10-4.el6, 3.4.10-4.el7, 3.4.10-6.fc31
python35 - addressed in versions 3.5.8-2.fc29, 3.5.8-2.fc30, 3.5.8-2.fc31
python36 - addressed in versions 3.6.10-1.fc30, 3.6.10-1.fc31
python3 - addressed in versions 3.7.5-1.fc29, 3.7.5-1.fc30, 3.7.5-1.fc31
python38 - addressed in versions 3.8.0~b4-1.fc29, 3.8.0~b4-1.fc30, 3.8.0~b4-1.fc31
python3.10-minimal (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.10 (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.12 (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python3.12-minimal (Ubuntu package) - update to 3.12.0-1ubuntu0.1
Data Computing Appliance (DCA) - update to 4.3.0.0

External References

Related Security Bulletins