CVE-2024-6923: Email header injection due to unquoted newlines

Deferred

AliasesALPINE-CVE-2024-6923SUSE-SU-2024:2974-1SUSE-SU-2024:3200-1+24 more

Published 01-08-2024Last modified 03-11-2025

Vulnerability summary

CVE-2024-6923 is a medium (CVSS 5.5) Improper Control of Generation of Code vulnerability in python software foundation cpython. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

1.10%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

01-08-2024
PublishedVulnerability first disclosed.
03-11-2025
Last modifiedVulnerability information updated.

Description

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

CVSS metrics

8 scores · 8 sources · 1 version

v3.15.5

EPSS trend

Probability

1.10%

Chance of exploitation in the next 30 days

Percentile

66%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.10% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat94 products

mod_wsgi< 0:4.7.1-4.module+el8.4.0+9822+20bf1249 | < 0:4.7.1-5.module+el8.7.0+16654+645aad7f
numpy< 0:1.19.4-2.module+el8.4.0+15042+dc5a279b.1 | < 0:1.19.4-3.module+el8.5.0+12204+54860423
numpy-debugsource< 0:1.19.4-2.module+el8.4.0+15042+dc5a279b.1 | < 0:1.19.4-3.module+el8.5.0+12204+54860423
python-cffi< 0:1.14.3-2.module+el8.4.0+9822+20bf1249
python-cffi-debugsource< 0:1.14.3-2.module+el8.4.0+9822+20bf1249

python-chardet< 0:3.0.4-19.module+el8.4.0+9822+20bf1249
python-cryptography< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python-cryptography-debugsource< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python-idna< 0:2.10-3.module+el8.4.0+9822+20bf1249
python-lxml< 0:4.6.2-2.module+el8.4.0+9822+20bf1249 | < 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c
python-lxml-debugsource< 0:4.6.2-2.module+el8.4.0+9822+20bf1249 | < 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c
python-ply< 0:3.11-10.module+el8.4.0+9822+20bf1249
python-psutil< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python-psutil-debugsource< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python-psycopg2< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python-psycopg2-debugsource< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python-pycparser< 0:2.20-3.module+el8.4.0+9822+20bf1249
python-PyMySQL< 0:0.10.1-2.module+el8.4.0+9822+20bf1249
python-pysocks< 0:1.7.1-4.module+el8.4.0+9822+20bf1249
python-requests< 0:2.25.0-2.module+el8.4.0+9822+20bf1249
python-toml< 0:0.10.1-5.module+el8.4.0+9822+20bf1249
python-urllib3< 0:1.25.10-3.module+el8.4.0+9822+20bf1249 | < 0:1.25.10-4.module+el8.5.0+11712+ea2d2be1
python-wheel< 1:0.35.1-3.module+el8.4.0+15042+dc5a279b.1 | < 1:0.35.1-4.module+el8.5.0+12204+54860423
python3.11< 0:3.11.7-1.el9_4.5
python3.11-debug< 0:3.11.7-1.el9_4.5
python3.11-debuginfo< 0:3.11.7-1.el9_4.5
python3.11-debugsource< 0:3.11.7-1.el9_4.5
python3.11-devel< 0:3.11.7-1.el9_4.5
python3.11-idle< 0:3.11.7-1.el9_4.5
python3.11-libs< 0:3.11.7-1.el9_4.5
python3.11-test< 0:3.11.7-1.el9_4.5
python3.11-tkinter< 0:3.11.7-1.el9_4.5
python3.12< 0:3.12.1-4.el9_4.3
python3.12-debug< 0:3.12.1-4.el9_4.3
python3.12-debuginfo< 0:3.12.1-4.el9_4.3
python3.12-debugsource< 0:3.12.1-4.el9_4.3
python3.12-devel< 0:3.12.1-4.el9_4.3
python3.12-idle< 0:3.12.1-4.el9_4.3
python3.12-libs< 0:3.12.1-4.el9_4.3
python3.12-test< 0:3.12.1-4.el9_4.3
python3.12-tkinter< 0:3.12.1-4.el9_4.3
python39< 0:3.9.2-2.module+el8.4.0+22261+25c4dd9f.3 | < 0:3.9.16-1.module+el8.8.0+22279+de7b033f.3
python39-cffi< 0:1.14.3-2.module+el8.4.0+9822+20bf1249
python39-cffi-debuginfo< 0:1.14.3-2.module+el8.4.0+9822+20bf1249
python39-chardet< 0:3.0.4-19.module+el8.4.0+9822+20bf1249
python39-cryptography< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python39-cryptography-debuginfo< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python39-debuginfo< 0:3.9.2-2.module+el8.4.0+22261+25c4dd9f.3 | < 0:3.9.16-1.module+el8.8.0+22279+de7b033f.3
python39-debugsource< 0:3.9.2-2.module+el8.4.0+22261+25c4dd9f.3 | < 0:3.9.16-1.module+el8.8.0+22279+de7b033f.3
python39-devel< 0:3.9.2-2.module+el8.4.0+22261+25c4dd9f.3 | < 0:3.9.16-1.module+el8.8.0+22279+de7b033f.3
python39-idle< 0:3.9.2-2.module+el8.4.0+22261+25c4dd9f.3 | < 0:3.9.16-1.module+el8.8.0+22279+de7b033f.3
python39-idna< 0:2.10-3.module+el8.4.0+9822+20bf1249
python39-libs< 0:3.9.2-2.module+el8.4.0+22261+25c4dd9f.3 | < 0:3.9.16-1.module+el8.8.0+22279+de7b033f.3
python39-lxml< 0:4.6.2-2.module+el8.4.0+9822+20bf1249 | < 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c
python39-lxml-debuginfo< 0:4.6.2-2.module+el8.4.0+9822+20bf1249 | < 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c
python39-mod_wsgi< 0:4.7.1-4.module+el8.4.0+9822+20bf1249 | < 0:4.7.1-5.module+el8.7.0+16654+645aad7f
python39-numpy< 0:1.19.4-2.module+el8.4.0+15042+dc5a279b.1 | < 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-numpy-debuginfo< 0:1.19.4-2.module+el8.4.0+15042+dc5a279b.1 | < 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-numpy-doc< 0:1.19.4-2.module+el8.4.0+15042+dc5a279b.1 | < 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-numpy-f2py< 0:1.19.4-2.module+el8.4.0+15042+dc5a279b.1 | < 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-pip< 0:20.2.4-3.module+el8.4.0+15042+dc5a279b.1 | < 0:20.2.4-7.module+el8.6.0+13003+6bb2c488
python39-pip-wheel< 0:20.2.4-3.module+el8.4.0+15042+dc5a279b.1 | < 0:20.2.4-7.module+el8.6.0+13003+6bb2c488
python39-ply< 0:3.11-10.module+el8.4.0+9822+20bf1249
python39-psutil< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python39-psutil-debuginfo< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python39-psycopg2< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-psycopg2-debuginfo< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-psycopg2-doc< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-psycopg2-tests< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-pycparser< 0:2.20-3.module+el8.4.0+9822+20bf1249
python39-PyMySQL< 0:0.10.1-2.module+el8.4.0+9822+20bf1249
python39-pysocks< 0:1.7.1-4.module+el8.4.0+9822+20bf1249
python39-pyyaml< 0:5.4.1-1.module+el8.4.0+10484+27ce8e03 | < 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
python39-pyyaml-debuginfo< 0:5.4.1-1.module+el8.4.0+10484+27ce8e03 | < 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
python39-requests< 0:2.25.0-2.module+el8.4.0+9822+20bf1249
python39-rpm-macros< 0:3.9.2-2.module+el8.4.0+22261+25c4dd9f.3 | < 0:3.9.16-1.module+el8.8.0+22279+de7b033f.3
python39-scipy< 0:1.5.4-3.module+el8.4.0+9822+20bf1249
python39-scipy-debuginfo< 0:1.5.4-3.module+el8.4.0+9822+20bf1249
python39-setuptools< 0:50.3.2-3.module+el8.4.0+22168+8a561f05.2 | < 0:50.3.2-6.module+el8.8.0+22158+89b6fb7b
python39-setuptools-wheel< 0:50.3.2-3.module+el8.4.0+22168+8a561f05.2 | < 0:50.3.2-6.module+el8.8.0+22158+89b6fb7b
python39-six< 0:1.15.0-3.module+el8.4.0+9822+20bf1249
python39-test< 0:3.9.2-2.module+el8.4.0+22261+25c4dd9f.3 | < 0:3.9.16-1.module+el8.8.0+22279+de7b033f.3
python39-tkinter< 0:3.9.2-2.module+el8.4.0+22261+25c4dd9f.3 | < 0:3.9.16-1.module+el8.8.0+22279+de7b033f.3
python39-toml< 0:0.10.1-5.module+el8.4.0+9822+20bf1249
python39-urllib3< 0:1.25.10-3.module+el8.4.0+9822+20bf1249 | < 0:1.25.10-4.module+el8.5.0+11712+ea2d2be1
python39-wheel< 1:0.35.1-3.module+el8.4.0+15042+dc5a279b.1 | < 1:0.35.1-4.module+el8.5.0+12204+54860423
python39-wheel-wheel< 1:0.35.1-3.module+el8.4.0+15042+dc5a279b.1 | < 1:0.35.1-4.module+el8.5.0+12204+54860423
python3x-pip< 0:20.2.4-3.module+el8.4.0+15042+dc5a279b.1 | < 0:20.2.4-7.module+el8.6.0+13003+6bb2c488
python3x-setuptools< 0:50.3.2-3.module+el8.4.0+22168+8a561f05.2 | < 0:50.3.2-6.module+el8.8.0+22158+89b6fb7b
python3x-six< 0:1.15.0-3.module+el8.4.0+9822+20bf1249
PyYAML< 0:5.4.1-1.module+el8.4.0+10484+27ce8e03 | < 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
PyYAML-debugsource< 0:5.4.1-1.module+el8.4.0+10484+27ce8e03 | < 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
scipy< 0:1.5.4-3.module+el8.4.0+9822+20bf1249
scipy-debugsource< 0:1.5.4-3.module+el8.4.0+9822+20bf1249

Show all 94

Suse33 products

python3-base&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 3.4.10-25.136.1
python3-base&distro=SUSE Linux Enterprise Server 12 SP5< 3.4.10-25.136.1
python3-base&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 3.4.10-25.136.1
python3-base&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 3.4.10-25.136.1
python310-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.10.14-150400.4.54.1

python310-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.10.14-150400.4.54.1
python310-core&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 3.10.14-150400.4.54.1
python310-core&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4< 3.10.14-150400.4.54.1
python310&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.10.14-150400.4.54.1
python310&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.10.14-150400.4.54.1
python310&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 3.10.14-150400.4.54.1
python310&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4< 3.10.14-150400.4.54.1
python311-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.11.9-150400.9.32.3
python311-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.11.9-150400.9.32.3
python311-core&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 3.11.9-150400.9.32.3
python311-core&distro=SUSE Linux Enterprise Module for Python 3 15 SP5< 3.11.9-150400.9.32.3
python311-core&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 3.11.9-150400.9.32.3
python311-core&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4< 3.11.9-150400.9.32.3
python311-documentation&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.11.9-150400.9.32.1
python311-documentation&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.11.9-150400.9.32.1
python311-documentation&distro=SUSE Linux Enterprise Module for Python 3 15 SP5< 3.11.9-150400.9.32.1
python311-documentation&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 3.11.9-150400.9.32.1
python311-documentation&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4< 3.11.9-150400.9.32.1
python311&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.11.9-150400.9.32.4
python311&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.11.9-150400.9.32.4
python311&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 3.11.9-150400.9.32.4
python311&distro=SUSE Linux Enterprise Module for Python 3 15 SP5< 3.11.9-150400.9.32.4
python311&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 3.11.9-150400.9.32.4
python311&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4< 3.11.9-150400.9.32.4
python3&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 3.4.10-25.136.1
python3&distro=SUSE Linux Enterprise Server 12 SP5< 3.4.10-25.136.1
python3&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 3.4.10-25.136.1
python3&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 3.4.10-25.136.1

Show all 33

Opensuse12 products

python310-core&distro=openSUSE Leap 15.5< 3.10.14-150400.4.54.1
python310-core&distro=openSUSE Leap 15.6< 3.10.14-150400.4.54.1
python310-documentation&distro=openSUSE Leap 15.5< 3.10.14-150400.4.54.1
python310-documentation&distro=openSUSE Leap 15.6< 3.10.14-150400.4.54.1
python310&distro=openSUSE Leap 15.5< 3.10.14-150400.4.54.1

Show all 12

Ubuntu10 products

python2.7< 2.7.6-8ubuntu0.6+esm21 | < 2.7.12-1ubuntu0~16.04.18+esm12 | < 2.7.17-1~18.04ubuntu1.13+esm7 | < 2.7.18-1~20.04.5 | < 2.7.18-13ubuntu1.3
python3.10< 3.10.12-1~22.04.6
python3.11All versions (No fix recorded)
python3.12< 3.12.3-1ubuntu0.2
python3.4All versions (No fix recorded)

Show all 10

Chainguard7 products

nodejs-18< 18.20.8-r4
nodejs-20< 20.19.5-r0
nodejs-22< 22.21.1-r0 | < 22.21.1-r1
python-3.10< 3.10.15-r0
python-3.11< 3.11.10-r0

Show all 7

Wolfi6 products

nodejs-18< 18.20.8-r4
nodejs-20< 20.19.5-r0
nodejs-22< 22.21.1-r0 | < 22.21.1-r1
python-3.10< 3.10.15-r0
python-3.11< 3.11.10-r0

Show all 6

Debian3 products

pypy3All versions (No fix recorded) | < 7.3.18+dfsg-1
python3.11< 3.11.2-6+deb12u5
python3.13< 3.13.0~rc2-1

Alpine1 product

python3< 3.10.15-r0 | < 3.11.10-r0 | < 3.12.6-r0 | < 3.12.5-r0

Python software foundation1 product

cpython< 3.8.20 | ≥ 3.9.0, < 3.9.20 | ≥ 3.10.0, < 3.10.15 | ≥ 3.11.0, < 3.11.10 | ≥ 3.12.0, < 3.12.5 | ≥ 3.13.0a1, < 3.13.0rc2

9 vendors · 167 products

References

42 links

github.com/python/cpython/pull/122233PatchARTICLEREPORTFIX
github.com/python/cpython/issues/121650Issue TrackingARTICLEREPORT
mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW/Vendor AdvisoryARTICLEREPORTAdvisory
github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7PatchFIX
github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0PatchFIX
github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147PatchFIX
github.com/python/cpython/commit/b158a76ce094897c870fb6b3de62887b7ccc33f1PatchFIX
github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6PatchFIX
github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533PatchFIX
github.com/python/cpython/commit/097633981879b3c9de9a1dd120d3aa585ecc2384PatchFIX

Show all 42 references