CVE-2019-16056
📋 TL;DR
The Python email module incorrectly parses email addresses containing multiple @ characters, allowing attackers to bypass email validation checks. Applications using Python's email module for From/To header validation are vulnerable to accepting malicious email addresses that should be rejected. This affects Python versions through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4.
💻 Affected Systems
- Python
- Applications using Python email module
📦 What is this software?
Communications Operations Monitor by Oracle
Communications Operations Monitor by Oracle
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Peoplesoft Enterprise Peopletools by Oracle
Peoplesoft Enterprise Peopletools by Oracle
Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Solaris by Oracle
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Attackers bypass email-based authentication systems, gain unauthorized access to accounts or systems, or inject malicious content through email validation bypass.
Likely Case
Email validation bypass allowing spoofed or malicious email addresses to pass through security checks, potentially enabling phishing or spam attacks.
If Mitigated
Limited impact with proper input validation and email parsing libraries that correctly handle multiple @ characters.
🎯 Exploit Status
Exploitation requires sending specially crafted email addresses with multiple @ characters to vulnerable applications. Similar to CVE-2019-11340 exploitation patterns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Python 2.7.17+, 3.5.8+, 3.6.10+, 3.7.5+, 3.8.0+
Vendor Advisory: https://www.python.org/downloads/
Restart Required: Yes
Instructions:
1. Identify Python version with 'python --version'. 2. Upgrade to patched version using system package manager or Python installer. 3. Restart all Python applications and services. 4. Test email parsing functionality.
🔧 Temporary Workarounds
Input validation workaround
allImplement custom email validation that rejects addresses with multiple @ characters before passing to Python email module
import re
def validate_email(email): return len(re.findall('@', email)) == 1
Use alternative email library
allReplace Python email module usage with third-party email validation libraries that handle multiple @ characters correctly
pip install email-validator
from email_validator import validate_email, EmailNotValidError
🧯 If You Can't Patch
- Implement strict input validation rejecting any email address containing more than one @ character
- Use Web Application Firewall (WAF) rules to block email addresses with multiple @ characters
🔍 How to Verify
Check if Vulnerable:
Test email parsing with address containing multiple @ characters: from email.utils import parseaddr; result = parseaddr('test@@example.com'); print(result)Check Version:
python --version or python -c 'import sys; print(sys.version)'Verify Fix Applied:
After patching, test same parsing - should return empty or properly parsed result without accepting invalid address📡 Detection & Monitoring
Log Indicators:
- Multiple @ characters in email addresses in application logs
- Failed email validation attempts followed by successful authentication
Network Indicators:
- Email traffic containing addresses with @@ patterns
- Unusual email format patterns in SMTP traffic
SIEM Query:
source="application.logs" AND "@@" AND ("email" OR "From:" OR "To:")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
- https://access.redhat.com/errata/RHSA-2019:3725
- https://access.redhat.com/errata/RHSA-2019:3948
- https://bugs.python.org/issue34155
- https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html
- https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/
- https://security.netapp.com/advisory/ntap-20190926-0005/
- https://usn.ubuntu.com/4151-1/
- https://usn.ubuntu.com/4151-2/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
- https://access.redhat.com/errata/RHSA-2019:3725
- https://access.redhat.com/errata/RHSA-2019:3948
- https://bugs.python.org/issue34155
- https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html
- https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/
- https://security.netapp.com/advisory/ntap-20190926-0005/
- https://usn.ubuntu.com/4151-1/
- https://usn.ubuntu.com/4151-2/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
