GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) by tdwyer · Pull Request #105127 · python/cpython

Conversation

@tdwyer

@tdwyer tdwyer commented May 31, 2023 •
edited by bedevere-bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

This PR is designed to detect parsing errors and return an empty tuple to indicate the parsing error. Additionally, this PR updates the test_email.py to check for these bugs, as well as, adds some other wacky Address Headers that are in the examples of RFC 2822 and makes sure they are being parsed correctly.

I realize that this PR dose not actually track down the bug and fix it. It simply detects the error has happened and returns a parsing error. However, Lib/email/utils.py is a much simpler file than Lib/email/_parseaddr.py, so it is much easier to review this change. Additionally, there are actually multiple bugs which are causing erroneous output. Tracing the code flow for each and fixing them would be prone to error considering all of the wacky stuff that RFC 2822 allows for in Address headers. Finally, this change is actually rather simple.

  • Issue: [CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tdwyer
pythongh-102988: Detect email address parsing errors and return empty…
81098ed 
… tuple to indicate the parsing error (old API)
@tdwyer
tdwyer requested a review from a team as a code owner May 31, 2023 02:07
@bedevere-bot bedevere-bot added the awaiting review label May 31, 2023
@bedevere-bot bedevere-bot mentioned this pull request May 31, 2023
[CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988
Closed
@bedevere-bot

bedevere-bot commented May 31, 2023

Copy link
Copy Markdown

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tdwyer tdwyer mentioned this pull request May 31, 2023
gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #102990
Closed
@tdwyer

tdwyer commented May 31, 2023

Copy link
Copy Markdown
Contributor Author

I had to create a new PR to replace the last one because Git got all messed up.

This is the old PR: #102990
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tdwyer tdwyer changed the title gh-102988: Detect email address parsing errors and return empty tupleto indicate the parsing error (old API) gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) May 31, 2023
@gpshead
r-prefix strs with \ in the tests
ecbb31c
@bedevere-bot

bedevere-bot commented May 31, 2023

Copy link
Copy Markdown

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead
reword getaddresses docstring
d8d2831
@bedevere-bot

This comment was marked as duplicate.

Sign in to view
gpshead
gpshead reviewed May 31, 2023
View reviewed changes
Comment thread Lib/email/utils.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
CharlieZhao95
CharlieZhao95 reviewed Jun 6, 2023
View reviewed changes
Comment thread Lib/email/utils.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/test/test_email/test_email.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@tdwyer
Update comment for getaddresses() and fix broken email test
b44a0b7
@bedevere-bot

This comment was marked as duplicate.

Sign in to view
@tdwyer

tdwyer commented Jun 7, 2023

Copy link
Copy Markdown
Contributor Author

Hum... it looks like CVE-2019-16056 was only fixed for parseaddr() and not getaddresses(). This PR happens to fix that too.
https://www.cve.org/CVERecord?id=CVE-2019-16056

getaddresses()

a = ['[email protected]<[email protected]>']
getaddresses(a)
[('', '[email protected]'), ('', '[email protected]')]

parseaddr()

a = ['[email protected]<[email protected]>']
parseaddr(a)
('', '[email protected]<[email protected]>')
gpshead reacted with laugh emoji gpshead reacted with hooray emoji
All reactions
  • 😄 1 reaction
  • 🎉 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tdwyer

tdwyer commented Jun 7, 2023

Copy link
Copy Markdown
Contributor Author

Should I add that NEWS entry that the Bot is asking for?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@CharlieZhao95

CharlieZhao95 commented Jun 7, 2023

Copy link
Copy Markdown
Contributor

Should I add that NEWS entry that the Bot is asking for?

I think it is needed, NEWS entry is required for most code modifications 😄. Please see: https://devguide.python.org/core-developers/committing/#updating-news-and-what-s-new-in-python
tdwyer reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tdwyer
Add NEWS
40002d9
@tdwyer

tdwyer commented Jun 14, 2023

Copy link
Copy Markdown
Contributor Author

I added NEWS entry, and all Unit tests have passed.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tdwyer
tdwyer requested review from CharlieZhao95 and gpshead June 17, 2023 19:05
@tdwyer

This comment was marked as resolved.

Sign in to view
@CharlieZhao95

This comment was marked as resolved.

Sign in to view
@gpshead
Merge branch 'main' into fix_issues102988
86ffb57
@gpshead

This comment was marked as resolved.

Sign in to view
@tdwyer
Fix NEWS entry. It was not a Module its Class email._parseaddr.Addres…
302ee76 
…sList
@zhuofeng6

This comment was marked as spam.

Sign in to view
@gpshead gpshead added the type-security A security issue label Jul 10, 2023
gpshead
gpshead approved these changes Jul 10, 2023
View reviewed changes
@bedevere-bot bedevere-bot added awaiting merge and removed awaiting review labels Jul 10, 2023
@gpshead
gpshead enabled auto-merge (squash) July 10, 2023 22:49
@gpshead

gpshead commented Jul 10, 2023

Copy link
Copy Markdown
Member

Docs updated, auto-merge set. The backports beyond 3.12 will require manual work to get version numbered things right. I'd like to let this bake in 3.12beta4 & 3.12rc1 for a while first to see if any practical issues arise before landing the backports in older releases.

it is a security issue so we could backport it all the way to 3.8, but lets see how things go first. it is not high severity.
CharlieZhao95 and phbno1 reacted with hooray emoji
All reactions
  • 🎉 2 reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead
gpshead merged commit 18dfbd0 into python:main Jul 10, 2023
@miss-islington

miss-islington commented Jul 10, 2023

Copy link
Copy Markdown
Contributor

Thanks @tdwyer for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the awaiting merge label Jul 10, 2023
@miss-islington

miss-islington commented Jul 10, 2023

Copy link
Copy Markdown
Contributor

Sorry, @tdwyer and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 18dfbd035775c15533d13a98e56b1d2bf5c65f00 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jul 10, 2023
@tdwyer @gpshead @miss-islington
pythongh-102988: Detect email address parsing errors and return empty…
e533e43 
… tuple to indicate the parsing error (old API) (pythonGH-105127)

Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least ameliorates CVE-2023-27043.

---------

(cherry picked from commit 18dfbd0)

Co-authored-by: Thomas Dwyer <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
@miss-islington

miss-islington commented Jul 10, 2023

Copy link
Copy Markdown
Contributor

Sorry @tdwyer and @gpshead, I had trouble checking out the 3.10 backport branch.
Please retry by removing and re-adding the "needs backport to 3.10" label.
Alternatively, you can backport using cherry_picker on the command line.
cherry_picker 18dfbd035775c15533d13a98e56b1d2bf5c65f00 3.10
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot

bedevere-bot commented Jul 10, 2023

Copy link
Copy Markdown

GH-106612 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the needs backport to 3.12 only security fixes label Jul 10, 2023
gpshead added a commit that referenced this pull request Jul 10, 2023
@miss-islington @tdwyer @gpshead
[3.12] gh-102988: Detect email address parsing errors and return empt…
30870c8 
…y tuple to indicate the parsing error (old API) (GH-105127) (#106612)

gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) (GH-105127)

Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least ameliorates CVE-2023-27043.

---------

(cherry picked from commit 18dfbd0)

Co-authored-by: Thomas Dwyer <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
@tdwyer-wish

tdwyer-wish commented Jul 12, 2023 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Hello @gpshead Are you going to take care of the backports/cherrypick for 3.10 and 3.11 I'd do them but I've never done that before... Hum, actually I don't think I have permission to do that.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead

gpshead commented Jul 12, 2023

Copy link
Copy Markdown
Member

i'll do them, the issue remains assigned to me as a reminder. (anyone can do it, it's just a matter of creating your PR as a fork of the relevant release branch and selecting the matching base branch in the github ui at pr creation time)
tdwyer-wish reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@CharlieZhao95

CharlieZhao95 commented Jul 12, 2023

Copy link
Copy Markdown
Contributor

Hello @gpshead Are you going to take care of the backports/cherrypick for 3.10 and 3.11 I'd do them but I've never done that before... Hum, actually I don't think I have permission to do that.

Please see https://devguide.python.org/core-developers/committing/#backporting-changes-to-an-older-version for details.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead

gpshead commented Jul 12, 2023

Copy link
Copy Markdown
Member

this appears to have caused #106669
rouilj reacted with confused emoji
All reactions
  • 😕 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
mcepl
mcepl reviewed Jul 13, 2023
View reviewed changes
Comment thread Doc/library/email.utils.rst
This method returns a list of 2-tuples of the form returned by ``parseaddr()``.
*fieldvalues* is a sequence of header field values as might be returned by
:meth:`Message.get_all <email.message.Message.get_all>`. Here's a simple
example that gets all the recipients of a message::

@mcepl mcepl Jul 13, 2023

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdwyer Is this right? Isn’t the next paragraph still a literal block? Why have you removed this colon?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
AlexWaygood reacted with thumbs up emoji tdwyer-wish reacted with eyes emoji
All reactions
  • 👍 1 reaction
  • 👀 1 reaction
gpshead added a commit to gpshead/cpython that referenced this pull request Jul 14, 2023
@gpshead
pythongh-106669: Revert "pythongh-102988: Detect email address parsin…
362793e 
…g errors and return empty tuple to indicate the parsing error (old API) (python#105127)"

This reverts commit 18dfbd0.

See python#106669.
@gpshead gpshead mentioned this pull request Jul 14, 2023
gh-106669: Revert "gh-102988: Detect email address parsing errors ... (#105127)" #106733
Merged
gpshead added a commit that referenced this pull request Jul 21, 2023
@gpshead
gh-106669: Revert "gh-102988: Detect email address parsing errors ... (…
a31dea1 
…#105127)" (#106733)

This reverts commit 18dfbd0.
Adds a regression test from the issue.

See #106669.
gpshead added a commit to gpshead/cpython that referenced this pull request Jul 21, 2023
@gpshead
[3.12] pythongh-106669: Revert "pythongh-102988: Detect email address…
4288c62 
… parsing errors ... (pythonGH-105127)" (pythonGH-106733)

This reverts commit 18dfbd0.
Adds a regression test from the issue.

See python#106669..
(cherry picked from commit a31dea1)

Co-authored-by: Gregory P. Smith <[email protected]>
gpshead added a commit that referenced this pull request Jul 21, 2023
@gpshead
[3.12] gh-106669: Revert "gh-102988: Detect email address parsing err…
656f624 
…ors ... (GH-105127)" (GH-106733) (#106941)

This reverts commit 18dfbd0.
Adds a regression test from the issue.

See #106669..
(cherry picked from commit a31dea1)
@gpshead gpshead mentioned this pull request Dec 14, 2023
[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() #111116
Merged
@smoser smoser mentioned this pull request Feb 26, 2024
python-3.11 - cherry pick upstream patch for CVE-2023-27043 wolfi-dev/os#13586
Merged
@serhiy-storchaka

serhiy-storchaka commented Aug 14, 2025

Copy link
Copy Markdown
Member

Reminder about backporting. @tdwyer @gpshead
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@encukou

encukou commented Aug 15, 2025

Copy link
Copy Markdown
Member

This change was rolled back in 3.12+ in #106669.
The fixed version, #111116, was backported to 3.8+.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@encukou encukou removed needs backport to 3.10 needs backport to 3.11 only security fixes labels Aug 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes
@CharlieZhao95 CharlieZhao95 Awaiting requested review from CharlieZhao95
+1 more reviewer
@mcepl mcepl mcepl left review comments
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

10 participants

@tdwyer @bedevere-bot @CharlieZhao95 @gpshead @zhuofeng6 @miss-islington @tdwyer-wish @serhiy-storchaka @encukou @mcepl
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.