An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00912.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected —

Configuration 1 [-]

OR cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Configuration 5 [-]

cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*

Configuration 6 [-]

OR cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*

Configuration 7 [-]

OR cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Ansible Tower 3.5 for RHEL 7
ansible-tower-35/ansible-tower:3.5.6-1 cpe:/a:redhat:ansible_tower:3.5::el7 RHBA-2020:1539 2020-04-22T00:00:00Z
Red Hat Ansible Tower 3.6 for RHEL 7
ansible-tower-36/ansible-tower:3.6.4-1 cpe:/a:redhat:ansible_tower:3.6::el7 RHBA-2020:1540 2020-04-22T00:00:00Z
Red Hat Enterprise Linux 7
python-0:2.7.5-88.el7 cpe:/o:redhat:enterprise_linux:7 RHSA-2020:1131 2020-03-31T00:00:00Z
python3-0:3.6.8-13.el7 cpe:/o:redhat:enterprise_linux:7 RHSA-2020:1132 2020-03-31T00:00:00Z
Red Hat Enterprise Linux 7.7 Extended Update Support
python-0:2.7.5-87.el7_7 cpe:/o:redhat:rhel_eus:7.7 RHSA-2020:2520 2020-06-12T00:00:00Z
Red Hat Enterprise Linux 8
python27:2.7-8020020200117110429.90f98d4f cpe:/a:redhat:enterprise_linux:8 RHSA-2020:1605 2020-04-28T00:00:00Z
python3-0:3.6.8-23.el8 cpe:/a:redhat:enterprise_linux:8 RHSA-2020:1764 2020-04-28T00:00:00Z
python3-0:3.6.8-23.el8 cpe:/o:redhat:enterprise_linux:8 RHSA-2020:1764 2020-04-28T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 6
rh-python36-python-0:3.6.9-2.el6 cpe:/a:redhat:rhel_software_collections:3::el6 RHSA-2019:3725 2019-11-06T00:00:00Z
python27-python-0:2.7.17-2.el6 cpe:/a:redhat:rhel_software_collections:3::el6 RHSA-2019:3948 2019-11-25T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-python36-python-0:3.6.9-2.el7 cpe:/a:redhat:rhel_software_collections:3::el7 RHSA-2019:3725 2019-11-06T00:00:00Z
python27-python-0:2.7.17-2.el7 cpe:/a:redhat:rhel_software_collections:3::el7 RHSA-2019:3948 2019-11-25T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
rh-python36-python-0:3.6.9-2.el7 cpe:/a:redhat:rhel_software_collections:3::el7 RHSA-2019:3725 2019-11-06T00:00:00Z
python27-python-0:2.7.17-2.el7 cpe:/a:redhat:rhel_software_collections:3::el7 RHSA-2019:3948 2019-11-25T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
rh-python36-python-0:3.6.9-2.el7 cpe:/a:redhat:rhel_software_collections:3::el7 RHSA-2019:3725 2019-11-06T00:00:00Z
python27-python-0:2.7.17-2.el7 cpe:/a:redhat:rhel_software_collections:3::el7 RHSA-2019:3948 2019-11-25T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
rh-python36-python-0:3.6.9-2.el7 cpe:/a:redhat:rhel_software_collections:3::el7 RHSA-2019:3725 2019-11-06T00:00:00Z
python27-python-0:2.7.17-2.el7 cpe:/a:redhat:rhel_software_collections:3::el7 RHSA-2019:3948 2019-11-25T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Canonical Subscribe
Ubuntu Linux Subscribe
Debian Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Fedora Subscribe
Opensuse Subscribe
Leap Subscribe
Oracle Subscribe
Communications Operations Monitor Subscribe
Peoplesoft Enterprise Peopletools Subscribe
Solaris Subscribe
Zfs Storage Appliance Kit Subscribe
Python Subscribe
Python Subscribe
Redhat Subscribe
Ansible Tower Subscribe
Enterprise Linux Subscribe
Rhel Eus Subscribe
Rhel Software Collections Subscribe
Software Collections Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-1924-1 python3.4 security update
Debian DLA Debian DLA DLA-1925-1 python2.7 security update
Debian DLA Debian DLA DLA-2280-1 python3.5 security update
Debian DLA Debian DLA DLA-2337-1 python2.7 security update
EUVD EUVD EUVD-2019-6919 An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.
Ubuntu USN Ubuntu USN USN-4151-1 Python vulnerabilities
Ubuntu USN Ubuntu USN USN-4151-2 Python vulnerabilities
Ubuntu USN Ubuntu USN USN-6891-1 Python vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3725 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3948 cve-icon cve-icon
https://bugs.python.org/issue34155 cve-icon cve-icon
https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9 cve-icon cve-icon
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-16056 cve-icon
https://security.netapp.com/advisory/ntap-20190926-0005/ cve-icon cve-icon
https://usn.ubuntu.com/4151-1/ cve-icon cve-icon
https://usn.ubuntu.com/4151-2/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-16056 cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-05T01:03:32.645Z

Reserved: 2019-09-06T00:00:00

Link: CVE-2019-16056

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-09-06T18:15:15.443

Modified: 2024-11-21T04:29:57.830

Link: CVE-2019-16056

cve-icon Redhat

Severity : Moderate

Publid Date: 2018-07-19T00:00:00Z

Links: CVE-2019-16056 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses