CVE-2023-27043

Advisory lineage Upstream: 0 Downstream: 44
Modified
Published: 18 Apr 2023, 00:00
Last modified:12 May 2026, 10:52

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
5.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.16% LOW
0% probability -0.02%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

18 Apr 2023, 00:00
Published
Vulnerability first disclosed
12 May 2026, 10:52
Last Modified
Vulnerability information updated

Description

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Trends

Current EPSS score: 0.16%• Percentile: 37%

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  • CWE-1286•Improper Validation of Syntactic Correctness of Input

    The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Affected Systems

  • fedoraproject•fedora

    38 | 39

  • netapp•active_iq_unified_manager

    na

  • netapp•ontap_select_deploy_administration_utility

    na

  • python•python

    ≤ 2.7.18 | ≥ 3.0, < 3.8.20 | ≥ 3.9.0, < 3.9.20 | ≥ 3.10.0, < 3.10.15 | ≥ 3.11.0, < 3.11.10 | ≥ 3.12.0, < 3.12.6

References (46)