CVE-2024-6923

NameCVE-2024-6923
DescriptionThere is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pypy (PTS)jessie2.4.0+dfsg-3vulnerable
stretch5.6.0+dfsg-4vulnerable
buster7.0.0+dfsg-3vulnerable
bullseye7.3.3+dfsg-2vulnerable
python2.7 (PTS)jessie, jessie (lts)2.7.9-2-ds1-1+deb8u12vulnerable
stretch (security)2.7.13-2+deb9u6vulnerable
stretch (lts), stretch2.7.13-2+deb9u9vulnerable
buster (security), buster, buster (lts)2.7.16-2+deb10u4vulnerable
bullseye2.7.18-8+deb11u1vulnerable
python3.11 (PTS)bookworm3.11.2-6+deb12u4vulnerable
bookworm (security)3.11.2-6+deb12u3vulnerable
python3.12 (PTS)sid, trixie3.12.7-3fixed
python3.13 (PTS)sid, trixie3.13.0-2fixed
python3.4 (PTS)jessie, jessie (lts)3.4.2-1+deb8u18vulnerable
python3.5 (PTS)stretch (security)3.5.3-1+deb9u5vulnerable
stretch (lts), stretch3.5.3-1+deb9u10vulnerable
python3.7 (PTS)buster, buster (lts)3.7.3-2+deb10u8vulnerable
buster (security)3.7.3-2+deb10u7vulnerable
python3.9 (PTS)bullseye3.9.2-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pypysourcejessie(unfixed)end-of-life
pypysource(unstable)(unfixed)
python2.7source(unstable)(unfixed)
python3.11source(unstable)(unfixed)
python3.12source(unstable)3.12.5-1
python3.13source(unstable)3.13.0~rc2-1
python3.4source(unstable)(unfixed)
python3.5source(unstable)(unfixed)
python3.7source(unstable)(unfixed)
python3.9source(unstable)(unfixed)

Notes

[bookworm] - python3.11 <postponed> (Minor issue, wait until merged into 3.11 branch)
[bullseye] - python3.9 <no-dsa> (Minor issue)
[bullseye] - python2.7 <ignored> (Unsupported in Bullseye, only included to build a few applications)
https://github.com/python/cpython/issues/121650
https://github.com/python/cpython/pull/122233
https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0 (v3.13.0rc2)
https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7 (v3.12.5)
https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533 (v3.11.10)
https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147 (v3.10.15)
https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6 (v3.9.20)
[buster] - pypy <postponed> (Minor issue)
[stretch] - pypy <postponed> (Minor issue)
[buster] - python2.7 <postponed> (Minor issue)
[stretch] - python2.7 <postponed> (Minor issue)
[jessie] - python2.7 <postponed> (Minor issue)
[jessie] - python3.4 <postponed> (Minor issue)
[stretch] - python3.5 <postponed> (Minor issue)
[buster] - python3.7 <postponed> (Minor issue)

Search for package or bug name: Reporting problems