CVE-2024-6923

NameCVE-2024-6923
DescriptionThere is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pypy (PTS)jessie2.4.0+dfsg-3vulnerable
stretch5.6.0+dfsg-4vulnerable
buster7.0.0+dfsg-3vulnerable
bullseye7.3.3+dfsg-2vulnerable
python2.7 (PTS)jessie, jessie (lts)2.7.9-2-ds1-1+deb8u12vulnerable
stretch (security)2.7.13-2+deb9u6vulnerable
stretch (lts), stretch2.7.13-2+deb9u9vulnerable
buster (security), buster, buster (lts)2.7.16-2+deb10u4vulnerable
bullseye2.7.18-8+deb11u1vulnerable
python3.11 (PTS)bookworm3.11.2-6+deb12u2vulnerable
bookworm (security)3.11.2-6+deb12u3vulnerable
python3.12 (PTS)trixie3.12.6-1fixed
sid3.12.7-1fixed
python3.13 (PTS)sid, trixie3.13.0-1fixed
python3.9 (PTS)bullseye3.9.2-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pypysourcejessie(unfixed)end-of-life
pypysource(unstable)(unfixed)
python2.7source(unstable)(unfixed)
python3.11source(unstable)(unfixed)
python3.12source(unstable)3.12.5-1
python3.13source(unstable)3.13.0~rc2-1
python3.9source(unstable)(unfixed)

Notes

[bookworm] - python3.11 <postponed> (Minor issue, wait until merged into 3.11 branch)
[bullseye] - python3.9 <no-dsa> (Minor issue)
[bullseye] - python2.7 <ignored> (Unsupported in Bullseye, only included to build a few applications)
https://github.com/python/cpython/issues/121650
https://github.com/python/cpython/pull/122233
https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0 (v3.13.0rc2)
https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7 (v3.12.5)
https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533 (v3.11.10)
https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147 (v3.10.15)
https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6 (v3.9.20)
[buster] - pypy <postponed> (Not backported to older branches yet.)
[stretch] - pypy <postponed> (Not backported to older branches yet.)
[buster] - python2.7 <postponed> (Not backported to older branches yet.)
[stretch] - python2.7 <postponed> (Not backported to older branches yet.)
[jessie] - python2.7 <postponed> (Not backported to older branches yet.)

Search for package or bug name: Reporting problems