gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) by tdwyer · Pull Request #105127 · python/cpython

tdwyer · 2023-05-31T02:07:28Z

This PR is designed to detect parsing errors and return an empty tuple to indicate the parsing error. Additionally, this PR updates the test_email.py to check for these bugs, as well as, adds some other wacky Address Headers that are in the examples of RFC 2822 and makes sure they are being parsed correctly.

I realize that this PR dose not actually track down the bug and fix it. It simply detects the error has happened and returns a parsing error. However, Lib/email/utils.py is a much simpler file than Lib/email/_parseaddr.py, so it is much easier to review this change. Additionally, there are actually multiple bugs which are causing erroneous output. Tracing the code flow for each and fixing them would be prone to error considering all of the wacky stuff that RFC 2822 allows for in Address headers. Finally, this change is actually rather simple.

Issue: [CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

… tuple to indicate the parsing error (old API)

bedevere-bot · 2023-05-31T02:07:34Z

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

tdwyer · 2023-05-31T02:12:13Z

I had to create a new PR to replace the last one because Git got all messed up.

This is the old PR: #102990

bedevere-bot · 2023-05-31T03:29:15Z

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

tdwyer · 2023-06-07T01:23:17Z

Hum... it looks like CVE-2019-16056 was only fixed for parseaddr() and not getaddresses(). This PR happens to fix that too.
https://www.cve.org/CVERecord?id=CVE-2019-16056

getaddresses()

a = ['a@b.com<z@x.com>']
getaddresses(a)
[('', 'a@b.com'), ('', 'z@x.com')]

parseaddr()

a = ['a@b.com<z@x.com>']
parseaddr(a)
('', 'a@b.com<z@x.com>')

tdwyer · 2023-06-07T01:25:03Z

Should I add that NEWS entry that the Bot is asking for?

CharlieZhao95 · 2023-06-07T01:31:07Z

Should I add that NEWS entry that the Bot is asking for?

I think it is needed, NEWS entry is required for most code modifications 😄. Please see: https://devguide.python.org/core-developers/committing/#updating-news-and-what-s-new-in-python

tdwyer · 2023-06-14T03:11:22Z

I added NEWS entry, and all Unit tests have passed.

…sList

gpshead · 2023-07-10T22:55:39Z

Docs updated, auto-merge set. The backports beyond 3.12 will require manual work to get version numbered things right. I'd like to let this bake in 3.12beta4 & 3.12rc1 for a while first to see if any practical issues arise before landing the backports in older releases.

it is a security issue so we could backport it all the way to 3.8, but lets see how things go first. it is not high severity.

miss-islington · 2023-07-10T23:00:59Z

Thanks @tdwyer for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12.
🐍🍒⛏🤖

miss-islington · 2023-07-10T23:01:07Z

Sorry, @tdwyer and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 18dfbd035775c15533d13a98e56b1d2bf5c65f00 3.11

… tuple to indicate the parsing error (old API) (pythonGH-105127) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least ameliorates CVE-2023-27043. --------- (cherry picked from commit 18dfbd0) Co-authored-by: Thomas Dwyer <github@tomd.tel> Co-authored-by: Gregory P. Smith <greg@krypto.org>

miss-islington · 2023-07-10T23:01:10Z

Sorry @tdwyer and @gpshead, I had trouble checking out the 3.10 backport branch.
Please retry by removing and re-adding the "needs backport to 3.10" label.
Alternatively, you can backport using cherry_picker on the command line.
cherry_picker 18dfbd035775c15533d13a98e56b1d2bf5c65f00 3.10

bedevere-bot · 2023-07-10T23:01:11Z

GH-106612 is a backport of this pull request to the 3.12 branch.

…y tuple to indicate the parsing error (old API) (GH-105127) (#106612) gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) (GH-105127) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least ameliorates CVE-2023-27043. --------- (cherry picked from commit 18dfbd0) Co-authored-by: Thomas Dwyer <github@tomd.tel> Co-authored-by: Gregory P. Smith <greg@krypto.org>

tdwyer-wish · 2023-07-12T00:34:48Z

Hello @gpshead Are you going to take care of the backports/cherrypick for 3.10 and 3.11 I'd do them but I've never done that before... Hum, actually I don't think I have permission to do that.

gpshead · 2023-07-12T00:50:02Z

i'll do them, the issue remains assigned to me as a reminder. (anyone can do it, it's just a matter of creating your PR as a fork of the relevant release branch and selecting the matching base branch in the github ui at pr creation time)

CharlieZhao95 · 2023-07-12T00:53:22Z

Hello @gpshead Are you going to take care of the backports/cherrypick for 3.10 and 3.11 I'd do them but I've never done that before... Hum, actually I don't think I have permission to do that.

Please see https://devguide.python.org/core-developers/committing/#backporting-changes-to-an-older-version for details.

gpshead · 2023-07-12T18:03:50Z

this appears to have caused #106669

mcepl · 2023-07-13T21:15:04Z

 This method returns a list of 2-tuples of the form returned by ``parseaddr()``.
 *fieldvalues* is a sequence of header field values as might be returned by
 :meth:`Message.get_all <email.message.Message.get_all>`. Here's a simple
- example that gets all the recipients of a message::


@tdwyer Is this right? Isn’t the next paragraph still a literal block? Why have you removed this colon?

…g errors and return empty tuple to indicate the parsing error (old API) (python#105127)" This reverts commit 18dfbd0. See python#106669.

…#105127)" (#106733) This reverts commit 18dfbd0. Adds a regression test from the issue. See #106669.

… parsing errors ... (pythonGH-105127)" (pythonGH-106733) This reverts commit 18dfbd0. Adds a regression test from the issue. See python#106669.. (cherry picked from commit a31dea1) Co-authored-by: Gregory P. Smith <greg@krypto.org>

…ors ... (GH-105127)" (GH-106733) (#106941) This reverts commit 18dfbd0. Adds a regression test from the issue. See #106669.. (cherry picked from commit a31dea1)

serhiy-storchaka · 2025-08-14T21:07:39Z

Reminder about backporting. @tdwyer @gpshead

encukou · 2025-08-15T11:22:20Z

This change was rolled back in 3.12+ in #106669.
The fixed version, #111116, was backported to 3.8+.

pythongh-102988: Detect email address parsing errors and return empty…
81098ed
… tuple to indicate the parsing error (old API)

tdwyer requested a review from a team as a code owner May 31, 2023 02:07

bedevere-bot added the awaiting review label May 31, 2023

bedevere-bot mentioned this pull request May 31, 2023
[CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988
Closed

tdwyer mentioned this pull request May 31, 2023
gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #102990
Closed

tdwyer changed the title ~~gh-102988: Detect email address parsing errors and return empty tupleto indicate the parsing error (old API)~~gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API)May 31, 2023

r-prefix strs with \ in the tests
ecbb31c

reword getaddresses docstring
d8d2831

This comment was marked as duplicate.
Sign in to view

gpshead reviewed May 31, 2023
View reviewed changes

Comment threadLib/email/utils.py Outdated

CharlieZhao95 reviewed Jun 6, 2023
View reviewed changes

Comment threadLib/email/utils.py Outdated
Comment threadLib/test/test_email/test_email.py Outdated

Update comment for getaddresses() and fix broken email test
b44a0b7

This comment was marked as duplicate.
Sign in to view

Add NEWS
40002d9

tdwyer requested review from CharlieZhao95 and gpshead June 17, 2023 19:05

This comment was marked as resolved.
Sign in to view

Merge branch 'main' into fix_issues102988
86ffb57

This comment was marked as resolved.
Sign in to view

Fix NEWS entry. It was not a Module its Class email._parseaddr.Addres…
302ee76
…sList

This comment was marked as spam.
Sign in to view

gpshead added the type-security A security issue label Jul 10, 2023

gpshead approved these changes Jul 10, 2023
View reviewed changes

bedevere-bot added awaiting merge and removed awaiting review labels Jul 10, 2023

gpshead enabled auto-merge (squash) July 10, 2023 22:49

gpshead merged commit 18dfbd0 into python:mainJul 10, 2023

bedevere-bot removed the awaiting merge label Jul 10, 2023

bedevere-bot removed the needs backport to 3.12 only security fixes label Jul 10, 2023

mcepl reviewed Jul 13, 2023
View reviewed changes

gpshead mentioned this pull request Jul 14, 2023
gh-106669: Revert "gh-102988: Detect email address parsing errors ... (#105127)" #106733
Merged

gpshead added a commit that referenced this pull request Jul 21, 2023
gh-106669: Revert "gh-102988: Detect email address parsing errors ... (…
a31dea1
…#105127)" (#106733) This reverts commit 18dfbd0. Adds a regression test from the issue. See #106669.

gpshead mentioned this pull request Dec 14, 2023
[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() #111116
Merged

smoser mentioned this pull request Feb 26, 2024
python-3.11 - cherry pick upstream patch for CVE-2023-27043 wolfi-dev/os#13586
Merged

encukou removed needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Aug 15, 2025

Uh oh!

Uh oh!

Conversation

tdwyer commented May 31, 2023• edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-bot commented May 31, 2023

Uh oh!

tdwyer commented May 31, 2023

Uh oh!

bedevere-bot commented May 31, 2023

Uh oh!

This comment was marked as duplicate.

Uh oh!

Uh oh!

Uh oh!

This comment was marked as duplicate.

tdwyer commented Jun 7, 2023

Uh oh!

tdwyer commented Jun 7, 2023

Uh oh!

CharlieZhao95 commented Jun 7, 2023

Uh oh!

tdwyer commented Jun 14, 2023

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as spam.

gpshead commented Jul 10, 2023

Uh oh!

miss-islington commented Jul 10, 2023

Uh oh!

miss-islington commented Jul 10, 2023

Uh oh!

miss-islington commented Jul 10, 2023

Uh oh!

bedevere-bot commented Jul 10, 2023

Uh oh!

tdwyer-wish commented Jul 12, 2023• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gpshead commented Jul 12, 2023

Uh oh!

CharlieZhao95 commented Jul 12, 2023

Uh oh!

gpshead commented Jul 12, 2023

Uh oh!

mceplJul 13, 2023

Choose a reason for hiding this comment

Uh oh!

serhiy-storchaka commented Aug 14, 2025

Uh oh!

encukou commented Aug 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

tdwyer commented May 31, 2023•
edited by bedevere-bot
Loading

tdwyer-wish commented Jul 12, 2023•
edited
Loading