Cloudanix VulnDB

CVE-2024-6923

Medium · 5.5

CVSS

5.5

EPSS

1.1%

Published

Aug 1, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in Python email code can let attackers sneak extra lines into messages sent by programs, which could mislead recipients or systems.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The email module fails to properly quote newlines when serializing email headers, permitting arbitrary header injection.

Why it matters to the business

Automated email systems built with Python may send messages containing unauthorized headers, increasing risk of content tampering or delivery manipulation in business communications.

How an attack unfolds

An attacker supplies input containing unquoted newlines within email header values; when the vulnerable email module serializes the message, the newlines allow injection of additional headers that can alter message semantics or routing.

How to fix it

Upgrade CPython to a build containing commit 06f28dc236708f72871c64d4bc4b4ea144c50147. Rebuild or redeploy any affected Python environments and dependent applications.

How to confirm the fix worked

Confirm the installed Python interpreter includes the referenced commit; test header serialization with newline-containing values to verify proper quoting occurs.

Typical attack path

  1. Locate Python code paths that construct and serialize email messages using the email module
  2. Supply crafted header values containing raw newlines
  3. Trigger message serialization
  4. Inspect or leverage the resulting injected headers in transit or at the recipient

How to detect it

Review application and mail server logs for serialized email messages containing unexpected or duplicate header fields; correlate with Python processes handling email construction.

What your security team should do

  • Prioritize patching all Python runtimes to the fixed commit
  • Audit applications that generate emails for direct use of the email module
  • Add runtime checks or wrappers around header construction until upgrades complete

The record

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 platform-python 0 3.6.8-67.el8_10.alma.1
AlmaLinux:8 platform-python-debug 0 3.6.8-67.el8_10.alma.1
AlmaLinux:8 platform-python-devel 0 3.6.8-67.el8_10.alma.1
AlmaLinux:8 python3-idle 0 3.6.8-67.el8_10.alma.1
AlmaLinux:8 python3-libs 0 3.6.8-67.el8_10.alma.1
AlmaLinux:8 python3-test 0 3.6.8-67.el8_10.alma.1
AlmaLinux:8 python3-tkinter 0 3.6.8-67.el8_10.alma.1
AlmaLinux:8 python3.11 0 3.11.9-7.el8_10
AlmaLinux:8 python3.11-debug 0 3.11.9-7.el8_10
AlmaLinux:8 python3.11-devel 0 3.11.9-7.el8_10
AlmaLinux:8 python3.11-idle 0 3.11.9-7.el8_10
AlmaLinux:8 python3.11-libs 0 3.11.9-7.el8_10
AlmaLinux:8 python3.11-rpm-macros 0 3.11.9-7.el8_10
AlmaLinux:8 python3.11-test 0 3.11.9-7.el8_10
AlmaLinux:8 python3.11-tkinter 0 3.11.9-7.el8_10
AlmaLinux:8 python3.12 0 3.12.5-2.el8_10
AlmaLinux:8 python3.12-debug 0 3.12.5-2.el8_10
AlmaLinux:8 python3.12-devel 0 3.12.5-2.el8_10
AlmaLinux:8 python3.12-idle 0 3.12.5-2.el8_10
AlmaLinux:8 python3.12-libs 0 3.12.5-2.el8_10
AlmaLinux:8 python3.12-rpm-macros 0 3.12.5-2.el8_10
AlmaLinux:8 python3.12-test 0 3.12.5-2.el8_10
AlmaLinux:8 python3.12-tkinter 0 3.12.5-2.el8_10
AlmaLinux:8 python39 0 3.9.19-7.module_el8.10.0+3885+d986a391
AlmaLinux:8 python39-Cython 0 0.29.21-5.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-Cython 0 0.29.21-5.module_el8.6.0+3248+c431e88c
AlmaLinux:8 python39-PyMySQL 0 0.10.1-2.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-attrs 0 20.3.0-2.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-cffi 0 1.14.3-2.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-cffi 0 1.14.3-2.module_el8.6.0+3248+c431e88c
AlmaLinux:8 python39-chardet 0 3.0.4-19.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-cryptography 0 3.3.1-3.module_el8.10.0+3765+2f9a457d
AlmaLinux:8 python39-debug 0 3.9.19-7.module_el8.10.0+3885+d986a391
AlmaLinux:8 python39-devel 0 3.9.19-7.module_el8.10.0+3885+d986a391
AlmaLinux:8 python39-idle 0 3.9.19-7.module_el8.10.0+3885+d986a391
AlmaLinux:8 python39-idna 0 2.10-4.module_el8.10.0+3849+a48d89aa
AlmaLinux:8 python39-iniconfig 0 1.1.1-2.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-libs 0 3.9.19-7.module_el8.10.0+3885+d986a391
AlmaLinux:8 python39-lxml 0 4.6.5-1.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-lxml 0 4.6.5-1.module_el8.6.0+3248+c431e88c
AlmaLinux:8 python39-mod_wsgi 0 4.7.1-7.module_el8.9.0+3634+fb2a896c
AlmaLinux:8 python39-more-itertools 0 8.5.0-2.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-numpy 0 1.19.4-3.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-numpy 0 1.19.4-3.module_el8.6.0+3248+c431e88c
AlmaLinux:8 python39-numpy-doc 0 1.19.4-3.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-numpy-f2py 0 1.19.4-3.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-numpy-f2py 0 1.19.4-3.module_el8.6.0+3248+c431e88c
AlmaLinux:8 python39-packaging 0 20.4-4.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-pip 0 20.2.4-9.module_el8.10.0+3765+2f9a457d
AlmaLinux:8 python39-pip-wheel 0 20.2.4-9.module_el8.10.0+3765+2f9a457d
AlmaLinux:8 python39-pluggy 0 0.13.1-3.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-ply 0 3.11-10.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-psutil 0 5.8.0-4.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-psutil 0 5.8.0-4.module_el8.6.0+3248+c431e88c
AlmaLinux:8 python39-psycopg2 0 2.8.6-3.module_el8.10.0+3765+2f9a457d
AlmaLinux:8 python39-psycopg2-doc 0 2.8.6-3.module_el8.10.0+3765+2f9a457d
AlmaLinux:8 python39-psycopg2-tests 0 2.8.6-3.module_el8.10.0+3765+2f9a457d
AlmaLinux:8 python39-py 0 1.10.0-1.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-pybind11 0 2.7.1-1.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-pybind11 0 2.7.1-1.module_el8.6.0+3248+c431e88c
AlmaLinux:8 python39-pybind11-devel 0 2.7.1-1.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-pybind11-devel 0 2.7.1-1.module_el8.6.0+3248+c431e88c
AlmaLinux:8 python39-pycparser 0 2.20-3.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-pyparsing 0 2.4.7-5.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-pysocks 0 1.7.1-4.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-pytest 0 6.0.2-2.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-pyyaml 0 5.4.1-1.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-pyyaml 0 5.4.1-1.module_el8.6.0+3248+c431e88c
AlmaLinux:8 python39-requests 0 2.25.0-3.module_el8.9.0+3634+fb2a896c
AlmaLinux:8 python39-rpm-macros 0 3.9.19-7.module_el8.10.0+3885+d986a391
AlmaLinux:8 python39-scipy 0 1.5.4-5.module_el8.9.0+3634+fb2a896c
AlmaLinux:8 python39-setuptools 0 50.3.2-6.module_el8.10.0+3885+d986a391
AlmaLinux:8 python39-setuptools-wheel 0 50.3.2-6.module_el8.10.0+3885+d986a391
AlmaLinux:8 python39-six 0 1.15.0-3.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-test 0 3.9.19-7.module_el8.10.0+3885+d986a391
AlmaLinux:8 python39-tkinter 0 3.9.19-7.module_el8.10.0+3885+d986a391
AlmaLinux:8 python39-toml 0 0.10.1-5.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-urllib3 0 1.25.10-5.module_el8.10.0+3765+2f9a457d
AlmaLinux:8 python39-wcwidth 0 0.2.5-3.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-wheel 0 1:0.35.1-4.module_el8.6.0+2780+a40f65e1
AlmaLinux:8 python39-wheel-wheel 0 1:0.35.1-4.module_el8.6.0+2780+a40f65e1
AlmaLinux:9 python-unversioned-command 0 3.9.18-3.el9_4.5
AlmaLinux:9 python3 0 3.9.18-3.el9_4.5
AlmaLinux:9 python3-debug 0 3.9.18-3.el9_4.5
AlmaLinux:9 python3-devel 0 3.9.18-3.el9_4.5
AlmaLinux:9 python3-idle 0 3.9.18-3.el9_4.5
AlmaLinux:9 python3-libs 0 3.9.18-3.el9_4.5
AlmaLinux:9 python3-test 0 3.9.18-3.el9_4.5
AlmaLinux:9 python3-tkinter 0 3.9.18-3.el9_4.5
AlmaLinux:9 python3.11 0 3.11.7-1.el9_4.5
AlmaLinux:9 python3.11-debug 0 3.11.7-1.el9_4.5
AlmaLinux:9 python3.11-devel 0 3.11.7-1.el9_4.5
AlmaLinux:9 python3.11-idle 0 3.11.7-1.el9_4.5
AlmaLinux:9 python3.11-libs 0 3.11.7-1.el9_4.5
AlmaLinux:9 python3.11-test 0 3.11.7-1.el9_4.5
AlmaLinux:9 python3.11-tkinter 0 3.11.7-1.el9_4.5
AlmaLinux:9 python3.12 0 3.12.1-4.el9_4.3
AlmaLinux:9 python3.12-debug 0 3.12.1-4.el9_4.3
AlmaLinux:9 python3.12-devel 0 3.12.1-4.el9_4.3
AlmaLinux:9 python3.12-idle 0 3.12.1-4.el9_4.3
AlmaLinux:9 python3.12-libs 0 3.12.1-4.el9_4.3
AlmaLinux:9 python3.12-test 0 3.12.1-4.el9_4.3
AlmaLinux:9 python3.12-tkinter 0 3.12.1-4.el9_4.3
Alpine:v3.17 python3 0 3.10.15-r0
Alpine:v3.18 python3 0 3.11.10-r0
Alpine:v3.19 python3 0 3.11.10-r0
Alpine:v3.20 python3 0 3.12.6-r0
Alpine:v3.21 python3 0 3.12.5-r0
Alpine:v3.22 python3 0 3.12.5-r0
Bitnami libpython 0 3.8.20
Bitnami python 0 3.12.5
Bitnami python 0 3.8.20
Bitnami python 3.12.0 3.12.5
Bitnami python-min 0 3.8.20
Chainguard nodejs-18 0 18.20.8-r4
Chainguard nodejs-18-doc 0 18.20.8-r4
Chainguard nodejs-20 0 20.19.5-r0
Chainguard nodejs-20-doc 0 20.19.5-r0
Chainguard nodejs-22 0 22.21.1-r1
Chainguard nodejs-22-doc 0 22.21.1-r1
Chainguard python-3.10 0 3.10.15-r0
Chainguard python-3.10-base 0 3.10.15-r0
Chainguard python-3.10-base-dev 0 3.10.15-r0
Chainguard python-3.10-dev 0 3.10.15-r0
Chainguard python-3.10-doc 0 3.10.15-r0
Chainguard python-3.11 0 3.11.10-r0
Chainguard python-3.11-base 0 3.11.10-r0
Chainguard python-3.11-base-dev 0 3.11.10-r0
Chainguard python-3.11-dev 0 3.11.10-r0
Chainguard python-3.11-doc 0 3.11.10-r0
Chainguard python-3.12 0 3.12.5-r0
Chainguard python-3.12-base 0 3.12.5-r0
Chainguard python-3.12-base-dev 0 3.12.5-r0
Chainguard python-3.12-dev 0 3.12.5-r0
Chainguard python-3.12-doc 0 3.12.5-r0
Chainguard python-3.12-privileged-netbindservice 0 3.12.5-r0
Chainguard python-3.12-tk 0 3.12.5-r0
Chainguard python-3.8 0 3.8.20-r0
Chainguard python-3.8-base 0 3.8.20-r0
Chainguard python-3.8-base-dev 0 3.8.20-r0
Chainguard python-3.8-default 0 3.8.20-r0
Chainguard python-3.8-dev 0 3.8.20-r0
Chainguard python-3.8-doc 0 3.8.20-r0
Chainguard python-3.9 0 3.9.20-r0
Chainguard python-3.9-base 0 3.9.20-r0
Chainguard python-3.9-base-dev 0 3.9.20-r0
Chainguard python-3.9-default 0 3.9.20-r0
Chainguard python-3.9-dev 0 3.9.20-r0
Chainguard python-3.9-doc 0 3.9.20-r0
Debian:11 pypy3 0 No fix
Debian:11 python2.7 0 No fix
Debian:11 python3.9 0 No fix
Debian:11 python3.9 0 3.9.2-1+deb11u2
Debian:12 pypy3 0 No fix
Debian:12 python3.11 0 No fix
Debian:13 pypy3 0 7.3.18+dfsg-1
Debian:13 python3.12 0 3.12.5-1
Debian:13 python3.13 0 3.13.0~rc2-1
Debian:14 pypy3 0 7.3.18+dfsg-1
Debian:14 python3.13 0 3.13.0~rc2-1
Mageia:9 python3 0 3.10.11-1.3.mga9
Red Hat:enterprise_linux:8::appstream PyYAML 0 0:5.4.1-1.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream PyYAML-debugsource 0 0:5.4.1-1.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream mod_wsgi 0 0:4.7.1-7.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream numpy 0 0:1.19.4-3.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream numpy-debugsource 0 0:1.19.4-3.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream platform-python 0 0:3.6.8-67.el8_10
Red Hat:enterprise_linux:8::appstream platform-python-debug 0 0:3.6.8-67.el8_10
Red Hat:enterprise_linux:8::appstream platform-python-devel 0 0:3.6.8-67.el8_10
Red Hat:enterprise_linux:8::appstream python-PyMySQL 0 0:0.10.1-2.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-cffi 0 0:1.14.3-2.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-cffi-debugsource 0 0:1.14.3-2.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-chardet 0 0:3.0.4-19.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-cryptography 0 0:3.3.1-3.module+el8.10.0+21271+eccd1d86
Red Hat:enterprise_linux:8::appstream python-cryptography-debugsource 0 0:3.3.1-3.module+el8.10.0+21271+eccd1d86
Red Hat:enterprise_linux:8::appstream python-idna 0 0:2.10-4.module+el8.10.0+21815+bb024982
Red Hat:enterprise_linux:8::appstream python-lxml 0 0:4.6.5-1.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-lxml-debugsource 0 0:4.6.5-1.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-ply 0 0:3.11-10.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-psutil 0 0:5.8.0-4.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-psutil-debugsource 0 0:5.8.0-4.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-psycopg2 0 0:2.8.6-3.module+el8.10.0+21142+453d2b75
Red Hat:enterprise_linux:8::appstream python-psycopg2-debugsource 0 0:2.8.6-3.module+el8.10.0+21142+453d2b75
Red Hat:enterprise_linux:8::appstream python-pycparser 0 0:2.20-3.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-pysocks 0 0:1.7.1-4.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-requests 0 0:2.25.0-3.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-toml 0 0:0.10.1-5.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python-urllib3 0 0:1.25.10-5.module+el8.10.0+20443+f0a692fe
Red Hat:enterprise_linux:8::appstream python-wheel 0 1:0.35.1-4.module+el8.9.0+19644+d68f775d
Red Hat:enterprise_linux:8::appstream python3 0 0:3.6.8-67.el8_10
Red Hat:enterprise_linux:8::appstream python3-debuginfo 0 0:3.6.8-67.el8_10
Red Hat:enterprise_linux:8::appstream python3-debugsource 0 0:3.6.8-67.el8_10
Red Hat:enterprise_linux:8::appstream python3-idle 0 0:3.6.8-67.el8_10
Red Hat:enterprise_linux:8::appstream python3-libs 0 0:3.6.8-67.el8_10
Red Hat:enterprise_linux:8::appstream python3-test 0 0:3.6.8-67.el8_10
Red Hat:enterprise_linux:8::appstream python3-tkinter 0 0:3.6.8-67.el8_10
Red Hat:enterprise_linux:8::appstream python3.11 0 0:3.11.9-7.el8_10
Red Hat:enterprise_linux:8::appstream python3.11-debug 0 0:3.11.9-7.el8_10
Red Hat:enterprise_linux:8::appstream python3.11-debuginfo 0 0:3.11.9-7.el8_10
Red Hat:enterprise_linux:8::appstream python3.11-debugsource 0 0:3.11.9-7.el8_10

Related vulnerabilities