CVE-2024-6923
Medium · 5.5CVSS
5.5
EPSS
1.1%
Published
Aug 1, 2024
CISA due date
—
Cloudanix analysis
A bug in Python email code can let attackers sneak extra lines into messages sent by programs, which could mislead recipients or systems.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Tampering
- Component
- Library
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The email module fails to properly quote newlines when serializing email headers, permitting arbitrary header injection.
Why it matters to the business
Automated email systems built with Python may send messages containing unauthorized headers, increasing risk of content tampering or delivery manipulation in business communications.
How an attack unfolds
An attacker supplies input containing unquoted newlines within email header values; when the vulnerable email module serializes the message, the newlines allow injection of additional headers that can alter message semantics or routing.
How to fix it
Upgrade CPython to a build containing commit 06f28dc236708f72871c64d4bc4b4ea144c50147. Rebuild or redeploy any affected Python environments and dependent applications.
How to confirm the fix worked
Confirm the installed Python interpreter includes the referenced commit; test header serialization with newline-containing values to verify proper quoting occurs.
Typical attack path
- Locate Python code paths that construct and serialize email messages using the email module
- Supply crafted header values containing raw newlines
- Trigger message serialization
- Inspect or leverage the resulting injected headers in transit or at the recipient
How to detect it
Review application and mail server logs for serialized email messages containing unexpected or duplicate header fields; correlate with Python processes handling email construction.
What your security team should do
- Prioritize patching all Python runtimes to the fixed commit
- Audit applications that generate emails for direct use of the email module
- Add runtime checks or wrappers around header construction until upgrades complete
The record
There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | platform-python | 0 | 3.6.8-67.el8_10.alma.1 |
| AlmaLinux:8 | platform-python-debug | 0 | 3.6.8-67.el8_10.alma.1 |
| AlmaLinux:8 | platform-python-devel | 0 | 3.6.8-67.el8_10.alma.1 |
| AlmaLinux:8 | python3-idle | 0 | 3.6.8-67.el8_10.alma.1 |
| AlmaLinux:8 | python3-libs | 0 | 3.6.8-67.el8_10.alma.1 |
| AlmaLinux:8 | python3-test | 0 | 3.6.8-67.el8_10.alma.1 |
| AlmaLinux:8 | python3-tkinter | 0 | 3.6.8-67.el8_10.alma.1 |
| AlmaLinux:8 | python3.11 | 0 | 3.11.9-7.el8_10 |
| AlmaLinux:8 | python3.11-debug | 0 | 3.11.9-7.el8_10 |
| AlmaLinux:8 | python3.11-devel | 0 | 3.11.9-7.el8_10 |
| AlmaLinux:8 | python3.11-idle | 0 | 3.11.9-7.el8_10 |
| AlmaLinux:8 | python3.11-libs | 0 | 3.11.9-7.el8_10 |
| AlmaLinux:8 | python3.11-rpm-macros | 0 | 3.11.9-7.el8_10 |
| AlmaLinux:8 | python3.11-test | 0 | 3.11.9-7.el8_10 |
| AlmaLinux:8 | python3.11-tkinter | 0 | 3.11.9-7.el8_10 |
| AlmaLinux:8 | python3.12 | 0 | 3.12.5-2.el8_10 |
| AlmaLinux:8 | python3.12-debug | 0 | 3.12.5-2.el8_10 |
| AlmaLinux:8 | python3.12-devel | 0 | 3.12.5-2.el8_10 |
| AlmaLinux:8 | python3.12-idle | 0 | 3.12.5-2.el8_10 |
| AlmaLinux:8 | python3.12-libs | 0 | 3.12.5-2.el8_10 |
| AlmaLinux:8 | python3.12-rpm-macros | 0 | 3.12.5-2.el8_10 |
| AlmaLinux:8 | python3.12-test | 0 | 3.12.5-2.el8_10 |
| AlmaLinux:8 | python3.12-tkinter | 0 | 3.12.5-2.el8_10 |
| AlmaLinux:8 | python39 | 0 | 3.9.19-7.module_el8.10.0+3885+d986a391 |
| AlmaLinux:8 | python39-Cython | 0 | 0.29.21-5.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-Cython | 0 | 0.29.21-5.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-PyMySQL | 0 | 0.10.1-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-attrs | 0 | 20.3.0-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-cffi | 0 | 1.14.3-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-cffi | 0 | 1.14.3-2.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-chardet | 0 | 3.0.4-19.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-cryptography | 0 | 3.3.1-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-debug | 0 | 3.9.19-7.module_el8.10.0+3885+d986a391 |
| AlmaLinux:8 | python39-devel | 0 | 3.9.19-7.module_el8.10.0+3885+d986a391 |
| AlmaLinux:8 | python39-idle | 0 | 3.9.19-7.module_el8.10.0+3885+d986a391 |
| AlmaLinux:8 | python39-idna | 0 | 2.10-4.module_el8.10.0+3849+a48d89aa |
| AlmaLinux:8 | python39-iniconfig | 0 | 1.1.1-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-libs | 0 | 3.9.19-7.module_el8.10.0+3885+d986a391 |
| AlmaLinux:8 | python39-lxml | 0 | 4.6.5-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-lxml | 0 | 4.6.5-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-mod_wsgi | 0 | 4.7.1-7.module_el8.9.0+3634+fb2a896c |
| AlmaLinux:8 | python39-more-itertools | 0 | 8.5.0-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy | 0 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy | 0 | 1.19.4-3.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-numpy-doc | 0 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy-f2py | 0 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy-f2py | 0 | 1.19.4-3.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-packaging | 0 | 20.4-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pip | 0 | 20.2.4-9.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-pip-wheel | 0 | 20.2.4-9.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-pluggy | 0 | 0.13.1-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-ply | 0 | 3.11-10.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-psutil | 0 | 5.8.0-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-psutil | 0 | 5.8.0-4.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-psycopg2 | 0 | 2.8.6-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-psycopg2-doc | 0 | 2.8.6-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-psycopg2-tests | 0 | 2.8.6-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-py | 0 | 1.10.0-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pybind11 | 0 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pybind11 | 0 | 2.7.1-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-pybind11-devel | 0 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pybind11-devel | 0 | 2.7.1-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-pycparser | 0 | 2.20-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pyparsing | 0 | 2.4.7-5.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pysocks | 0 | 1.7.1-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pytest | 0 | 6.0.2-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pyyaml | 0 | 5.4.1-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pyyaml | 0 | 5.4.1-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-requests | 0 | 2.25.0-3.module_el8.9.0+3634+fb2a896c |
| AlmaLinux:8 | python39-rpm-macros | 0 | 3.9.19-7.module_el8.10.0+3885+d986a391 |
| AlmaLinux:8 | python39-scipy | 0 | 1.5.4-5.module_el8.9.0+3634+fb2a896c |
| AlmaLinux:8 | python39-setuptools | 0 | 50.3.2-6.module_el8.10.0+3885+d986a391 |
| AlmaLinux:8 | python39-setuptools-wheel | 0 | 50.3.2-6.module_el8.10.0+3885+d986a391 |
| AlmaLinux:8 | python39-six | 0 | 1.15.0-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-test | 0 | 3.9.19-7.module_el8.10.0+3885+d986a391 |
| AlmaLinux:8 | python39-tkinter | 0 | 3.9.19-7.module_el8.10.0+3885+d986a391 |
| AlmaLinux:8 | python39-toml | 0 | 0.10.1-5.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-urllib3 | 0 | 1.25.10-5.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-wcwidth | 0 | 0.2.5-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-wheel | 0 | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-wheel-wheel | 0 | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:9 | python-unversioned-command | 0 | 3.9.18-3.el9_4.5 |
| AlmaLinux:9 | python3 | 0 | 3.9.18-3.el9_4.5 |
| AlmaLinux:9 | python3-debug | 0 | 3.9.18-3.el9_4.5 |
| AlmaLinux:9 | python3-devel | 0 | 3.9.18-3.el9_4.5 |
| AlmaLinux:9 | python3-idle | 0 | 3.9.18-3.el9_4.5 |
| AlmaLinux:9 | python3-libs | 0 | 3.9.18-3.el9_4.5 |
| AlmaLinux:9 | python3-test | 0 | 3.9.18-3.el9_4.5 |
| AlmaLinux:9 | python3-tkinter | 0 | 3.9.18-3.el9_4.5 |
| AlmaLinux:9 | python3.11 | 0 | 3.11.7-1.el9_4.5 |
| AlmaLinux:9 | python3.11-debug | 0 | 3.11.7-1.el9_4.5 |
| AlmaLinux:9 | python3.11-devel | 0 | 3.11.7-1.el9_4.5 |
| AlmaLinux:9 | python3.11-idle | 0 | 3.11.7-1.el9_4.5 |
| AlmaLinux:9 | python3.11-libs | 0 | 3.11.7-1.el9_4.5 |
| AlmaLinux:9 | python3.11-test | 0 | 3.11.7-1.el9_4.5 |
| AlmaLinux:9 | python3.11-tkinter | 0 | 3.11.7-1.el9_4.5 |
| AlmaLinux:9 | python3.12 | 0 | 3.12.1-4.el9_4.3 |
| AlmaLinux:9 | python3.12-debug | 0 | 3.12.1-4.el9_4.3 |
| AlmaLinux:9 | python3.12-devel | 0 | 3.12.1-4.el9_4.3 |
| AlmaLinux:9 | python3.12-idle | 0 | 3.12.1-4.el9_4.3 |
| AlmaLinux:9 | python3.12-libs | 0 | 3.12.1-4.el9_4.3 |
| AlmaLinux:9 | python3.12-test | 0 | 3.12.1-4.el9_4.3 |
| AlmaLinux:9 | python3.12-tkinter | 0 | 3.12.1-4.el9_4.3 |
| Alpine:v3.17 | python3 | 0 | 3.10.15-r0 |
| Alpine:v3.18 | python3 | 0 | 3.11.10-r0 |
| Alpine:v3.19 | python3 | 0 | 3.11.10-r0 |
| Alpine:v3.20 | python3 | 0 | 3.12.6-r0 |
| Alpine:v3.21 | python3 | 0 | 3.12.5-r0 |
| Alpine:v3.22 | python3 | 0 | 3.12.5-r0 |
| Bitnami | libpython | 0 | 3.8.20 |
| Bitnami | python | 0 | 3.12.5 |
| Bitnami | python | 0 | 3.8.20 |
| Bitnami | python | 3.12.0 | 3.12.5 |
| Bitnami | python-min | 0 | 3.8.20 |
| Chainguard | nodejs-18 | 0 | 18.20.8-r4 |
| Chainguard | nodejs-18-doc | 0 | 18.20.8-r4 |
| Chainguard | nodejs-20 | 0 | 20.19.5-r0 |
| Chainguard | nodejs-20-doc | 0 | 20.19.5-r0 |
| Chainguard | nodejs-22 | 0 | 22.21.1-r1 |
| Chainguard | nodejs-22-doc | 0 | 22.21.1-r1 |
| Chainguard | python-3.10 | 0 | 3.10.15-r0 |
| Chainguard | python-3.10-base | 0 | 3.10.15-r0 |
| Chainguard | python-3.10-base-dev | 0 | 3.10.15-r0 |
| Chainguard | python-3.10-dev | 0 | 3.10.15-r0 |
| Chainguard | python-3.10-doc | 0 | 3.10.15-r0 |
| Chainguard | python-3.11 | 0 | 3.11.10-r0 |
| Chainguard | python-3.11-base | 0 | 3.11.10-r0 |
| Chainguard | python-3.11-base-dev | 0 | 3.11.10-r0 |
| Chainguard | python-3.11-dev | 0 | 3.11.10-r0 |
| Chainguard | python-3.11-doc | 0 | 3.11.10-r0 |
| Chainguard | python-3.12 | 0 | 3.12.5-r0 |
| Chainguard | python-3.12-base | 0 | 3.12.5-r0 |
| Chainguard | python-3.12-base-dev | 0 | 3.12.5-r0 |
| Chainguard | python-3.12-dev | 0 | 3.12.5-r0 |
| Chainguard | python-3.12-doc | 0 | 3.12.5-r0 |
| Chainguard | python-3.12-privileged-netbindservice | 0 | 3.12.5-r0 |
| Chainguard | python-3.12-tk | 0 | 3.12.5-r0 |
| Chainguard | python-3.8 | 0 | 3.8.20-r0 |
| Chainguard | python-3.8-base | 0 | 3.8.20-r0 |
| Chainguard | python-3.8-base-dev | 0 | 3.8.20-r0 |
| Chainguard | python-3.8-default | 0 | 3.8.20-r0 |
| Chainguard | python-3.8-dev | 0 | 3.8.20-r0 |
| Chainguard | python-3.8-doc | 0 | 3.8.20-r0 |
| Chainguard | python-3.9 | 0 | 3.9.20-r0 |
| Chainguard | python-3.9-base | 0 | 3.9.20-r0 |
| Chainguard | python-3.9-base-dev | 0 | 3.9.20-r0 |
| Chainguard | python-3.9-default | 0 | 3.9.20-r0 |
| Chainguard | python-3.9-dev | 0 | 3.9.20-r0 |
| Chainguard | python-3.9-doc | 0 | 3.9.20-r0 |
| Debian:11 | pypy3 | 0 | No fix |
| Debian:11 | python2.7 | 0 | No fix |
| Debian:11 | python3.9 | 0 | No fix |
| Debian:11 | python3.9 | 0 | 3.9.2-1+deb11u2 |
| Debian:12 | pypy3 | 0 | No fix |
| Debian:12 | python3.11 | 0 | No fix |
| Debian:13 | pypy3 | 0 | 7.3.18+dfsg-1 |
| Debian:13 | python3.12 | 0 | 3.12.5-1 |
| Debian:13 | python3.13 | 0 | 3.13.0~rc2-1 |
| Debian:14 | pypy3 | 0 | 7.3.18+dfsg-1 |
| Debian:14 | python3.13 | 0 | 3.13.0~rc2-1 |
| Mageia:9 | python3 | 0 | 3.10.11-1.3.mga9 |
| Red Hat:enterprise_linux:8::appstream | PyYAML | 0 | 0:5.4.1-1.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | PyYAML-debugsource | 0 | 0:5.4.1-1.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | mod_wsgi | 0 | 0:4.7.1-7.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | numpy | 0 | 0:1.19.4-3.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | numpy-debugsource | 0 | 0:1.19.4-3.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | platform-python | 0 | 0:3.6.8-67.el8_10 |
| Red Hat:enterprise_linux:8::appstream | platform-python-debug | 0 | 0:3.6.8-67.el8_10 |
| Red Hat:enterprise_linux:8::appstream | platform-python-devel | 0 | 0:3.6.8-67.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python-PyMySQL | 0 | 0:0.10.1-2.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-cffi | 0 | 0:1.14.3-2.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-cffi-debugsource | 0 | 0:1.14.3-2.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-chardet | 0 | 0:3.0.4-19.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-cryptography | 0 | 0:3.3.1-3.module+el8.10.0+21271+eccd1d86 |
| Red Hat:enterprise_linux:8::appstream | python-cryptography-debugsource | 0 | 0:3.3.1-3.module+el8.10.0+21271+eccd1d86 |
| Red Hat:enterprise_linux:8::appstream | python-idna | 0 | 0:2.10-4.module+el8.10.0+21815+bb024982 |
| Red Hat:enterprise_linux:8::appstream | python-lxml | 0 | 0:4.6.5-1.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-lxml-debugsource | 0 | 0:4.6.5-1.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-ply | 0 | 0:3.11-10.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-psutil | 0 | 0:5.8.0-4.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-psutil-debugsource | 0 | 0:5.8.0-4.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-psycopg2 | 0 | 0:2.8.6-3.module+el8.10.0+21142+453d2b75 |
| Red Hat:enterprise_linux:8::appstream | python-psycopg2-debugsource | 0 | 0:2.8.6-3.module+el8.10.0+21142+453d2b75 |
| Red Hat:enterprise_linux:8::appstream | python-pycparser | 0 | 0:2.20-3.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-pysocks | 0 | 0:1.7.1-4.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-requests | 0 | 0:2.25.0-3.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-toml | 0 | 0:0.10.1-5.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python-urllib3 | 0 | 0:1.25.10-5.module+el8.10.0+20443+f0a692fe |
| Red Hat:enterprise_linux:8::appstream | python-wheel | 0 | 1:0.35.1-4.module+el8.9.0+19644+d68f775d |
| Red Hat:enterprise_linux:8::appstream | python3 | 0 | 0:3.6.8-67.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python3-debuginfo | 0 | 0:3.6.8-67.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python3-debugsource | 0 | 0:3.6.8-67.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python3-idle | 0 | 0:3.6.8-67.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python3-libs | 0 | 0:3.6.8-67.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python3-test | 0 | 0:3.6.8-67.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python3-tkinter | 0 | 0:3.6.8-67.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python3.11 | 0 | 0:3.11.9-7.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python3.11-debug | 0 | 0:3.11.9-7.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python3.11-debuginfo | 0 | 0:3.11.9-7.el8_10 |
| Red Hat:enterprise_linux:8::appstream | python3.11-debugsource | 0 | 0:3.11.9-7.el8_10 |
Related vulnerabilities
- CVE-2024-11168 The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts… Also affects platform-python
- CVE-2024-9287 A vulnerability has been found in the CPython `venv` module and CLI where path names… Also affects platform-python
- CVE-2024-6232 There is a MEDIUM severity vulnerability affecting CPython. Also affects platform-python
- CVE-2024-4032 The “ipaddress” module contained incorrect information about whether certain IPv4 and… Also affects platform-python
- CVE-2024-0450 An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7… Also affects platform-python
- CVE-2023-6597 An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions… Also affects platform-python
- CVE-2023-27043 The email module of Python through 3.11.3 incorrectly parses e-mail addresses that… Also affects platform-python
- CVE-2007-4559 Directory traversal vulnerability in the (1) extract and (2) extractall functions in the… Also affects platform-python