CVE-2023-36632
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-36632 is a vulnerability affecting the legacy email.utils.parseaddr function in Python up to version 3.11.4. This issue permits attackers to induce a "RecursionError: maximum recursion depth exceeded while calling a Python object" by supplying a crafted argument. This argument, which is expected to include a name and an email address, is an untrusted value from application input data. Although email.utils.parseaddr is categorized as a Legacy API, the vendor maintains that this is not a vulnerability or a bug. They argue that the email package is designed to have size limits and throw an exception when these limits are surpassed, which occurred in the demonstration code.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Python
Affected Vendors
- Python Software Foundation
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions