[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr()#111116

vstinner · 2023-10-20T14:20:59Z

Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer.

Issue: [CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

📚 Documentation preview 📚: https://cpython-previews--111116.org.readthedocs.build/

vstinner · 2023-10-20T14:25:12Z

@gpshead @serhiy-storchaka @bitdancer @warsaw: Would you mind to review this security fix?

See issue gh-102988 for the context.

This PR is a copy of PR #108250 but I added strict=True parameter, so it's possible to get the old behavior. I added tests on both modes, strict=True and strict=False.

vstinner · 2023-10-20T15:27:59Z

This PR is a copy of PR #108250 but I added strict=True parameter

My colleague Lumir Balhar @frenzymadness ran an impact check of PR #108250 on Fedora: in short, there is no impact, the test suite of all Python packages (in Fedora) pass with the change. While there were some build errors, they were unrelated to the email issue. For details, see https://copr.fedorainfracloud.org/coprs/lbalhar/email-CVE/builds/ COPR which as more than 4300 builds.

Now with an additional strict parameter, if there is any impacted project, at least there is a way to "opt out".

vstinner · 2023-10-20T15:29:04Z

@tdwyer: Would you mind to review my change, to see if I preserved your work correctly? (code and tests)

vstinner · 2023-10-27T14:04:13Z

I think that we should backport the change to all branches accepting security fixes. Problem: the change refer to version numbers, which as .. versionchanged:: 3.13. I suppose that if the change is backported, we should compute the next version of each branch, so backport manually.

vstinner · 2023-10-27T14:04:50Z

@ambv @SethMichaelLarson: Would you mind to review this PR?

ambv · 2023-10-27T15:31:40Z

Why is this a separate PR from #108250?

serhiy-storchaka · 2023-10-27T16:34:38Z

Doc/whatsnew/3.13.rst

 parameter to these two functions: use ``strict=False`` to get the old
 behavior, accept malformed inputs.
- (Contributed by Thomas Dwyer for :gh:`102988` to ameliorate CVE-2023-27043
+ (Contributed by Thomas Dwyer for :gh:`102988` to improve the CVE-2023-27043


TIL a new word.

serhiy-storchaka · 2023-10-27T16:42:14Z

Lib/email/utils.py


 specialsre = re.compile(r'[][\\()<>@,:;".]')
 escapesre = re.compile(r'[\\"]')
+realname_comma_re = re.compile(r'"[^"]*,[^"]*"')


Suggested change
realname_comma_re=re.compile(r'"[^"]*,[^"]*"')
realname_comma_re=re.compile(r'"[^",]*+,[^"]*+"')
It is faster. But I am not sure that the use of such regex is correct.

serhiy-storchaka · 2023-10-27T16:58:26Z

Lib/email/utils.py

+def _pre_parse_validation(email_header_fields):
+ accepted_values = []
+ for v in email_header_fields:
+ s = v.replace('\\(', '').replace('\\)', '')


But what if that backslash was already escaped with a backslash? For example \\) or \\\\).

Lib/email/utils.py

vstinner · 2023-10-27T20:25:47Z

Why is this a separate PR from #108250?

I'm not the author of the other PR. I copied the other PR and added strict parameter.

ambv · 2023-10-27T20:54:44Z

I'm not the author of this PR and I was able to make commits to it.

vstinner · 2023-10-28T22:37:18Z

I'm not the author of this PR and I was able to make commits to it.

I don't feel comfortable to make significant change of a PR without asking the author. I prefer to create a separated PR and ask for review.

vstinner · 2023-10-30T13:11:53Z

Is this behavior a bug or a feature? I don't know how ; is supposed to behave.

Details

$ python Python 3.11.6 (main, Oct 3 2023, 00:00:00) [GCC 13.2.1 20230728 (Red Hat 13.2.1-1)] on linux Type "help", "copyright", "credits" or "license" for more information. >>> from email.utils import getaddresses >>> from pprint import pprint >>> pprint(getaddresses('<[email protected]> <[email protected]>')) [('', ''), ('', 'b'), ('', 'o'), ('', 'b'), ('', ''), ('', 'e'), ('', 'x'), ('', 'a'), ('', 'm'), ('', 'p'), ('', 'l'), ('', 'e'), ('', '.'), ('', 'o'), ('', 'r'), ('', 'g'), ('', ''), ('', ''), ('', ''), ('', ''), ('', 'a'), ('', 'l'), ('', 'i'), ('', 'c'), ('', 'e'), ('', ''), ('', 'e'), ('', 'x'), ('', 'a'), ('', 'm'), ('', 'p'), ('', 'l'), ('', 'e'), ('', '.'), ('', 'o'), ('', 'r'), ('', 'g'), ('', '')]

vstinner · 2023-10-30T13:13:45Z

Is this behavior a bug or a feature? I don't know how ; is supposed to behave.

Oh. getaddresses() expects a sequence, not a string :-)

vstinner · 2023-10-30T13:46:33Z

Except of parsedate_tz() function, Lib/email/_parseaddr.py file didn't evolve much it was added in 2002 by commit 030ddf7. The file was created from Lib/rfc822.py which was added in 1992 (commit 01ca336).

The latest major change was done in... 1997 with commit be7c45e

New address parser by Ben Escoto replaces Sjoerd Mullender's parseaddr()

The latest minor change was done in 2019 to fix CVE-2019-16056: commit 8cb65d1 of issue #78336.

vstinner · 2023-10-30T13:48:56Z

What if the input is '"Jane Doe" [email protected], "John Doe" [email protected]'?

Oh, realname_comma_re replaces "Jane Doe" <[email protected]>, "John Doe" <[email protected]> with "Jane Doe <[email protected]> which is invalid...

vstinner · 2023-10-30T14:03:05Z

Email addresses have multiple standards:

1982: https://datatracker.ietf.org/doc/html/rfc822
2001: https://datatracker.ietf.org/doc/html/rfc2822 (replace 822)
2008: https://datatracker.ietf.org/doc/html/rfc5322 (replace 2822)
2012: https://datatracker.ietf.org/doc/html/rfc6532

miss-islington-app · 2024-09-06T09:35:01Z

Sorry, @vstinner, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19 3.9

miss-islington-app · 2024-09-06T09:35:15Z

Sorry, @vstinner, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19 3.8

…n email.parseaddr() (pythonGH-111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. Co-Authored-By: Thomas Dwyer <[email protected]> (cherry picked from commit 4a153a1)

…n email.parseaddr() (pythonGH-111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. (cherry picked from commit 4a153a1) Co-authored-by: Victor Stinner <[email protected]> Co-Authored-By: Thomas Dwyer <[email protected]>

…n email.parseaddr() (pythonGH-111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. Co-Authored-By: Thomas Dwyer <[email protected]> (cherry picked from commit 4a153a1)

bedevere-app · 2024-09-06T09:45:28Z

GH-123766 is a backport of this pull request to the 3.12 branch.

…n email.parseaddr() (pythonGH-111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. (cherry picked from commit 4a153a1) Co-authored-by: Victor Stinner <[email protected]> Co-Authored-By: Thomas Dwyer <[email protected]>

bedevere-app · 2024-09-06T09:55:01Z

GH-123767 is a backport of this pull request to the 3.11 branch.

…n email.parseaddr() (pythonGH-111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. (cherry picked from commit 4a153a1) Co-authored-by: Victor Stinner <[email protected]> Co-Authored-By: Thomas Dwyer <[email protected]>

bedevere-app · 2024-09-06T10:03:03Z

GH-123768 is a backport of this pull request to the 3.10 branch.

…l.parseaddr() (GH-111116) (#123766) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. Co-Authored-By: Thomas Dwyer <[email protected]> (cherry picked from commit 4a153a1) Co-authored-by: Victor Stinner <[email protected]>

…l.parseaddr() (GH-111116) (#123767) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. (cherry picked from commit 4a153a1) Co-authored-by: Victor Stinner <[email protected]> Co-authored-by: Thomas Dwyer <[email protected]>

… email.parseaddr() (pythonGH-111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. (cherry picked from commit 4a153a1) Co-authored-by: Victor Stinner <[email protected]> Co-Authored-By: Thomas Dwyer <[email protected]>

bedevere-app · 2024-09-06T10:50:33Z

GH-123769 is a backport of this pull request to the 3.9 branch.

… email.parseaddr() (pythonGH-111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. (cherry picked from commit 4a153a1) Co-authored-by: Victor Stinner <[email protected]> Co-Authored-By: Thomas Dwyer <[email protected]>

bedevere-app · 2024-09-06T10:56:31Z

GH-123770 is a backport of this pull request to the 3.8 branch.

….parseaddr() (GH-111116) (#123769) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. (cherry picked from commit 4a153a1) Co-authored-by: Victor Stinner <[email protected]> Co-Authored-By: Thomas Dwyer <[email protected]>

….parseaddr() (GH-111116) (#123770) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. (cherry picked from commit 4a153a1) Co-authored-by: Victor Stinner <[email protected]> Co-Authored-By: Thomas Dwyer <[email protected]>

…l.parseaddr() (GH-111116) (#123768) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. (cherry picked from commit 4a153a1) Co-authored-by: Victor Stinner <[email protected]> Co-Authored-By: Thomas Dwyer <[email protected]>

…n email.parseaddr() (python#111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. Co-Authored-By: Thomas Dwyer <[email protected]>

GPHemsley · 2025-06-01T01:47:18Z

supports_strict_parsing is not mentioned in the email.utils docs.

gpshead · 2025-06-01T02:59:58Z

please open a new issue if there's a lingering docs problem.

…n email.parseaddr() (python#111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. Co-Authored-By: Thomas Dwyer <[email protected]>

vstinner requested a review from a team as a code owner October 20, 2023 14:21

bedevere-appbot mentioned this pull request Oct 20, 2023
[CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988
Closed

bedevere-appbot added the awaiting core review label Oct 20, 2023

vstinner force-pushed the parse_email branch from 8fdc842 to c67d8f9Compare October 20, 2023 14:23

vstinner mentioned this pull request Oct 20, 2023
gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #108250
Closed

vstinner added type-security A security issue needs backport to 3.8 needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Oct 27, 2023

ambv changed the title ~~gh-102988: email parseaddr() now rejects malformed address~~gh-102988: Reject malformed addresses in email.parseaddr()Oct 27, 2023

serhiy-storchaka reviewed Oct 27, 2023
View reviewed changes

serhiy-storchaka self-requested a review October 27, 2023 16:39

serhiy-storchaka reviewed Oct 27, 2023
View reviewed changes

vstinner marked this pull request as draft October 30, 2023 14:20

bedevere-appbot removed the needs backport to 3.12 only security fixes label Sep 6, 2024

bedevere-appbot removed the needs backport to 3.11 only security fixes label Sep 6, 2024

bedevere-appbot removed the needs backport to 3.10 only security fixes label Sep 6, 2024

bedevere-appbot removed the needs backport to 3.9 label Sep 6, 2024

bedevere-appbot removed the needs backport to 3.8 label Sep 6, 2024

encukou mentioned this pull request Aug 15, 2025
gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #105127
Merged

	realname_comma_re=re.compile(r'"[^"],[^"]"')
	realname_comma_re=re.compile(r'"[^",]+,[^"]+"')

Uh oh!

[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr()#111116

[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() #111116

Uh oh!

Conversation

vstinner commented Oct 20, 2023• edited by github-actions botLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner commented Oct 20, 2023

Uh oh!

vstinner commented Oct 20, 2023

Uh oh!

vstinner commented Oct 20, 2023

Uh oh!

vstinner commented Oct 27, 2023

Uh oh!

vstinner commented Oct 27, 2023

Uh oh!

ambv commented Oct 27, 2023

Uh oh!

serhiy-storchakaOct 27, 2023

Choose a reason for hiding this comment

Uh oh!

serhiy-storchakaOct 27, 2023

Choose a reason for hiding this comment

Uh oh!

serhiy-storchakaOct 27, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

vstinner commented Oct 27, 2023

Uh oh!

ambv commented Oct 27, 2023

Uh oh!

vstinner commented Oct 28, 2023

Uh oh!

vstinner commented Oct 30, 2023• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner commented Oct 30, 2023

Uh oh!

vstinner commented Oct 30, 2023

Uh oh!

vstinner commented Oct 30, 2023

Uh oh!

vstinner commented Oct 30, 2023

Uh oh!

miss-islington-appbot commented Sep 6, 2024

Uh oh!

miss-islington-appbot commented Sep 6, 2024

Uh oh!

bedevere-appbot commented Sep 6, 2024

Uh oh!

bedevere-appbot commented Sep 6, 2024

Uh oh!

bedevere-appbot commented Sep 6, 2024

Uh oh!

bedevere-appbot commented Sep 6, 2024

Uh oh!

bedevere-appbot commented Sep 6, 2024

Uh oh!

GPHemsley commented Jun 1, 2025

Uh oh!

gpshead commented Jun 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

vstinner commented Oct 20, 2023•
edited by github-actions bot
Loading

vstinner commented Oct 30, 2023•
edited
Loading