2.3

CVE-2025-1795

Mishandling of comma during folding and unicode-encoding of email headers

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerPython Software Foundation
≫
Produkt CPython
Default Statusunaffected
Version 0
Version < 3.10.17
Status affected
Version 3.11.0
Version < 3.11.9
Status affected
Version 3.12.0
Version < 3.12.3
Status affected
Version 3.13.0a1
Version < 3.13.0a5
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.433
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cna@python.org 2.3 0 0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-116 Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48
https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593
https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74
https://github.com/python/cpython/issues/100884
https://github.com/python/cpython/pull/100885
https://github.com/python/cpython/pull/119099
https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/
https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d
https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090
https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html