[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() by vstinner · Pull Request #111116 · python/cpython · GitHub

Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer.

Issue: [CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

📚 Documentation preview 📚: https://cpython-previews--111116.org.readthedocs.build/

@gpshead @serhiy-storchaka @bitdancer @warsaw: Would you mind to review this security fix?

See issue gh-102988 for the context.

This PR is a copy of PR #108250 but I added strict=True parameter, so it's possible to get the old behavior. I added tests on both modes, strict=True and strict=False.

This PR is a copy of PR #108250 but I added strict=True parameter

My colleague Lumir Balhar @frenzymadness ran an impact check of PR #108250 on Fedora: in short, there is no impact, the test suite of all Python packages (in Fedora) pass with the change. While there were some build errors, they were unrelated to the email issue. For details, see https://copr.fedorainfracloud.org/coprs/lbalhar/email-CVE/builds/ COPR which as more than 4300 builds.

Now with an additional strict parameter, if there is any impacted project, at least there is a way to "opt out".

@tdwyer: Would you mind to review my change, to see if I preserved your work correctly? (code and tests)

I think that we should backport the change to all branches accepting security fixes. Problem: the change refer to version numbers, which as .. versionchanged:: 3.13. I suppose that if the change is backported, we should compute the next version of each branch, so backport manually.

@ambv @SethMichaelLarson: Would you mind to review this PR?

Why is this a separate PR from #108250?

TIL a new word.

Suggested change

      
            realname_comma_re = re.compile(r'"[^"]*,[^"]*"')
          
            realname_comma_re = re.compile(r'"[^",]*+,[^"]*+"')

It is faster. But I am not sure that the use of such regex is correct.

But what if that backslash was already escaped with a backslash? For example \\) or \\\\).

Why is this a separate PR from #108250?

I'm not the author of the other PR. I copied the other PR and added strict parameter.

I'm not the author of this PR and I was able to make commits to it.

I'm not the author of this PR and I was able to make commits to it.

I don't feel comfortable to make significant change of a PR without asking the author. I prefer to create a separated PR and ask for review.

Is this behavior a bug or a feature? I don't know how ; is supposed to behave.

Details

$ python
Python 3.11.6 (main, Oct  3 2023, 00:00:00) [GCC 13.2.1 20230728 (Red Hat 13.2.1-1)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from email.utils import getaddresses
>>> from pprint import pprint
>>> pprint(getaddresses('<bob@example.org>; <alice@example.org>'))
[('', ''),
 ('', 'b'),
 ('', 'o'),
 ('', 'b'),
 ('', ''),
 ('', 'e'),
 ('', 'x'),
 ('', 'a'),
 ('', 'm'),
 ('', 'p'),
 ('', 'l'),
 ('', 'e'),
 ('', '.'),
 ('', 'o'),
 ('', 'r'),
 ('', 'g'),
 ('', ''),
 ('', ''),
 ('', ''),
 ('', ''),
 ('', 'a'),
 ('', 'l'),
 ('', 'i'),
 ('', 'c'),
 ('', 'e'),
 ('', ''),
 ('', 'e'),
 ('', 'x'),
 ('', 'a'),
 ('', 'm'),
 ('', 'p'),
 ('', 'l'),
 ('', 'e'),
 ('', '.'),
 ('', 'o'),
 ('', 'r'),
 ('', 'g'),
 ('', '')]

Is this behavior a bug or a feature? I don't know how ; is supposed to behave.

Oh. getaddresses() expects a sequence, not a string :-)

Except of parsedate_tz() function, Lib/email/_parseaddr.py file didn't evolve much it was added in 2002 by commit 030ddf7. The file was created from Lib/rfc822.py which was added in 1992 (commit 01ca336).

The latest major change was done in... 1997 with commit be7c45e

New address parser by Ben Escoto replaces Sjoerd Mullender's parseaddr()

The latest minor change was done in 2019 to fix CVE-2019-16056: commit 8cb65d1 of issue #78336.

What if the input is '"Jane Doe" jane@example.net, "John Doe" john@example.net'?

Oh, realname_comma_re replaces "Jane Doe" <jane@example.net>, "John Doe" <john@example.net> with "Jane Doe <john@example.net> which is invalid...

Email addresses have multiple standards:

1982: https://datatracker.ietf.org/doc/html/rfc822
2001: https://datatracker.ietf.org/doc/html/rfc2822 (replace 822)
2008: https://datatracker.ietf.org/doc/html/rfc5322 (replace 2822)
2012: https://datatracker.ietf.org/doc/html/rfc6532

Is it time to backport the change to Python 3.8-3.12? So far, nobody reported any regression in Python 3.13.

Patch for Python 3.8
Patch for Python 3.9
Patch for Python 3.6

Of course, I am eager for reviews and comments.

So far, the only issue I have heard about was confusion about str/unicode objects in Python 2.7 (https://bugzilla.suse.com/1222537), which I think may be your problem as well.

Also, I left some comments on that commit.

Is it time to backport the change to Python 3.8-3.12

According to this comment, not yet: #102988 (comment)

…n email.parseaddr() (python#111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. Co-Authored-By: Thomas Dwyer <github@tomd.tel>

….parseaddr() (python#111116) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. Co-Authored-By: Thomas Dwyer <github@tomd.tel>

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.9.
🐍🍒⛏🤖

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖

Sorry, @vstinner, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19 3.12

Sorry, @vstinner, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19 3.10

Sorry, @vstinner, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19 3.11

Sorry, @vstinner, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19 3.9

Sorry, @vstinner, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19 3.8

GH-123766 is a backport of this pull request to the 3.12 branch.

GH-123767 is a backport of this pull request to the 3.11 branch.

GH-123768 is a backport of this pull request to the 3.10 branch.

GH-123769 is a backport of this pull request to the 3.9 branch.

GH-123770 is a backport of this pull request to the 3.8 branch.

supports_strict_parsing is not mentioned in the email.utils docs.

please open a new issue if there's a lingering docs problem.

vstinner requested a review from a team as a code owner October 20, 2023 14:21

bedevere-app Bot mentioned this pull request Oct 20, 2023

[CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

Closed

bedevere-app Bot added the awaiting core review label Oct 20, 2023

vstinner force-pushed the parse_email branch from 8fdc842 to c67d8f9 Compare October 20, 2023 14:23

vstinner mentioned this pull request Oct 20, 2023

gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #108250

Closed

vstinner added type-security A security issue needs backport to 3.8 needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Oct 27, 2023

ambv changed the title gh-102988: email parseaddr() now rejects malformed address gh-102988: Reject malformed addresses in email.parseaddr() Oct 27, 2023

serhiy-storchaka reviewed Oct 27, 2023

View reviewed changes

serhiy-storchaka self-requested a review October 27, 2023 16:39

serhiy-storchaka reviewed Oct 27, 2023

View reviewed changes

vstinner marked this pull request as draft October 30, 2023 14:20

sethmlarson mentioned this pull request Aug 5, 2024

Add a fixed commit for PSF-2023-2 psf/advisory-database#42

Merged

encukou added needs backport to 3.8 needs backport to 3.10 only security fixes labels Sep 6, 2024

encukou mentioned this pull request Aug 15, 2025

gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #105127

Merged

This was referenced Jul 8, 2026

mail-parser TypeError: getaddresses() unexpected keyword 'strict' on old Python patch releases (upstream #808) mkilijanek/parsedmarc-core#30

Closed

[Bug]: getmessages fails with invalid parameter 'strict' domainaware/parsedmarc#808

Closed

                 parameter to these two functions: use ``strict=False`` to get the old
                 behavior, accept malformed inputs.
-                (Contributed by Thomas Dwyer for :gh:`102988` to ameliorate CVE-2023-27043
+                (Contributed by Thomas Dwyer for :gh:`102988` to improve the CVE-2023-27043

+              def _pre_parse_validation(email_header_fields):
+                  accepted_values = []
+                  for v in email_header_fields:
+                      s = v.replace('\\(', '').replace('\\)', '')

               specialsre = re.compile(r'[][\\()<>@,:;".]')
               escapesre = re.compile(r'[\\"]')
+              realname_comma_re = re.compile(r'"[^"]*,[^"]*"')

	realname_comma_re = re.compile(r'"[^"],[^"]"')
	realname_comma_re = re.compile(r'"[^",]+,[^"]+"')

[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() by vstinner · Pull Request #111116 · python/cpython · GitHub

Uh oh!

Uh oh!

[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() - #111116

[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr()#111116vstinner merged 14 commits intopython:mainpython/cpython:mainfrom vstinner:parse_emailvstinner/cpython:parse_emailCopy head branch name to clipboard

Conversation

vstinner commented Oct 20, 2023 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner commented Oct 20, 2023

Uh oh!

vstinner commented Oct 20, 2023

Uh oh!

vstinner commented Oct 20, 2023

Uh oh!

vstinner commented Oct 27, 2023

Uh oh!

vstinner commented Oct 27, 2023

Uh oh!

ambv commented Oct 27, 2023

Uh oh!

serhiy-storchaka Oct 27, 2023

Choose a reason for hiding this comment

Uh oh!

serhiy-storchaka Oct 27, 2023

Choose a reason for hiding this comment

Uh oh!

serhiy-storchaka Oct 27, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

vstinner commented Oct 27, 2023

Uh oh!

ambv commented Oct 27, 2023

Uh oh!

vstinner commented Oct 28, 2023

Uh oh!

vstinner commented Oct 30, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner commented Oct 30, 2023

Uh oh!

vstinner commented Oct 30, 2023

Uh oh!

vstinner commented Oct 30, 2023

Uh oh!

vstinner commented Oct 30, 2023

Uh oh!

vstinner commented Apr 17, 2024

Uh oh!

mcepl commented Apr 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

encukou commented Apr 22, 2024

Uh oh!

miss-islington-app Bot commented Sep 6, 2024

Uh oh!

miss-islington-app Bot commented Sep 6, 2024

Uh oh!

miss-islington-app Bot commented Sep 6, 2024

Uh oh!

miss-islington-app Bot commented Sep 6, 2024

Uh oh!

miss-islington-app Bot commented Sep 6, 2024

Uh oh!

miss-islington-app Bot commented Sep 6, 2024

Uh oh!

miss-islington-app Bot commented Sep 6, 2024

Uh oh!

miss-islington-app Bot commented Sep 6, 2024

Uh oh!

miss-islington-app Bot commented Sep 6, 2024

Uh oh!

miss-islington-app Bot commented Sep 6, 2024

Uh oh!

bedevere-app Bot commented Sep 6, 2024

Uh oh!

bedevere-app Bot commented Sep 6, 2024

Uh oh!

[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr()#111116
vstinner merged 14 commits into
python:mainfrom
vstinner:parse_email

vstinner commented Oct 20, 2023 •
edited by github-actions Bot
Loading

vstinner commented Oct 30, 2023 •
edited
Loading

mcepl commented Apr 17, 2024 •
edited
Loading