CVE-2023-27043

一、漏洞信息
 漏洞编号：[CVE-2023-27043](https://nvd.nist.gov/vuln/detail/CVE-2023-27043)
 漏洞归属组件：[python3](https://gitee.com/src-openeuler/python3)
 漏洞归属的版本：3.10.0,3.10.2,3.10.9,3.11.1,3.11.4,3.11.6,3.7.9,3.8.5,3.9.9
 CVSS V3.0分值：
  BaseScore：5.3 Medium
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
 漏洞简述：
  The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.
 漏洞公开时间：2023-04-19 08:15:07
 漏洞创建时间：2023-05-23 06:50:13
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-27043
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | http://python.org |  |
| cve.mitre.org | https://github.com/python/cpython/issues/102988 |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/ |  |
| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/ |  |
| cve.mitre.org | https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html |  |
| cve.mitre.org | https://security.netapp.com/advisory/ntap-20230601-0003/ |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-27043 | https://bugzilla.suse.com/show_bug.cgi?id=1210638 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-27043 | https://bugzilla.suse.com/show_bug.cgi?id=1210638 |
| suse_bugzilla | http://python.com | https://bugzilla.suse.com/show_bug.cgi?id=1210638 |
| suse_bugzilla | https://github.com/python/cpython/issues/102988 | https://bugzilla.suse.com/show_bug.cgi?id=1210638 |
| redhat_bugzilla | https://github.com/python/cpython/issues/102988 | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | http://python.org | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | https://github.com/advisories/GHSA-5mwm-wccq-xqcp | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | https://github.com/python/cpython/pull/108250 | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:0256 | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:0466 | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:0454 | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:0430 | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:0586 | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2292 | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2985 | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3062 | https://bugzilla.redhat.com/show_bug.cgi?id=2196183 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-27043 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-27043 |
| cve_search |  | https://github.com/python/cpython/issues/102988 |
| cve_search |  | http://python.org |
| cve_search |  | https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html |
| cve_search |  | https://security.netapp.com/advisory/ntap-20230601-0003/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/ |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0317.html |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-27043 | https://explore.alas.aws.amazon.com/CVE-2023-27043.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27043 | https://explore.alas.aws.amazon.com/CVE-2023-27043.html |
| snyk | https://github.com/python/cpython/issues/102988 | https://security.snyk.io/vuln/SNYK-UNMANAGED-PYTHON-5457943 |
| snyk | https://github.com/python/cpython/pull/102990 | https://security.snyk.io/vuln/SNYK-UNMANAGED-PYTHON-5457943 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/python/cpython/pull/108250 |  | redhat_bugzilla |
|  |  | https://github.com/python/cpython/pull/102990 |  | snyk |
|  |  | https://github.com/python/cpython/issues/102988 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Python中电子邮件模块的一个安全漏洞。在某些情况下，含有特殊字符的电子邮件地址会被错误地解析，导致RFC2822头部的错误部分被识别为addr-spec的值。这可能会导致攻击者绕过验证特定域名（例如，只有@company.example.com地址可用于注册）后才授予应用程序访问权限的保护机制。该漏洞出现在最近版本的Python中的email/_parseaddr.py中。
 openEuler评分：
  5.3
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(3.7.9):受影响
2.openEuler-22.03-LTS-LoongArch(3.9.9):受影响
3.openEuler-22.03-LTS-SP1(3.9.9):受影响
4.openEuler-22.03-LTS-SP3(3.9.9):受影响
5.openEuler-22.03-LTS-SP4(3.9.9):受影响
6.openEuler-24.03-LTS(3.11.6):受影响
7.openEuler-24.03-LTS-Next(3.11.6):受影响
8.openEuler-24.03-LTS-SP1:受影响
9.openEuler-24.09:受影响
10.master(3.11.6):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(3.7.9):否
2.openEuler-22.03-LTS-LoongArch(3.9.9):否
3.openEuler-22.03-LTS-SP1(3.9.9):否
4.openEuler-22.03-LTS-SP3(3.9.9):否
5.openEuler-22.03-LTS-SP4(3.9.9):否
6.openEuler-24.03-LTS(3.11.6):否
7.openEuler-24.03-LTS-Next(3.11.6):否
8.openEuler-24.03-LTS-SP1:否
9.openEuler-24.09:否
10.master(3.11.6):否

原因说明：
  1.master(3.11.6):
2.openEuler-20.03-LTS-SP4(3.7.9):
3.openEuler-22.03-LTS-SP1(3.9.9):
4.openEuler-22.03-LTS-SP3(3.9.9):
5.openEuler-22.03-LTS-SP4(3.9.9):
6.openEuler-24.03-LTS(3.11.6):
7.openEuler-24.03-LTS-Next(3.11.6):
8.openEuler-24.03-LTS-SP1:

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2421

src-openEuler/python3
关闭

内容风险标识

评论 (30)

src-openEuler/python3关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-27043

评论 (30)

搜索帮助

src-openEuler/python3
关闭