CVE-2023-36632
📋 TL;DR
This CVE describes a recursion vulnerability in Python's legacy email.utils.parseaddr function that allows attackers to cause a RecursionError via crafted input. This can lead to denial of service in applications that use this function to parse untrusted email addresses. Affected are Python applications using the vulnerable function with user-supplied input.
💻 Affected Systems
- Python
📦 What is this software?
Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →⚠️ Risk & Real-World Impact
Worst Case
Application crashes due to RecursionError, causing denial of service and potential service disruption.
Likely Case
Denial of service in affected applications when parsing malicious email addresses, requiring application restart.
If Mitigated
Minimal impact if applications use proper input validation or the recommended email.parser classes instead.
🎯 Exploit Status
Proof of concept code is publicly available. Exploitation requires the application to use parseaddr() on attacker-controlled input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None - Python developers consider this expected behavior, not a vulnerability
Vendor Advisory: https://github.com/python/cpython/issues/103800
Restart Required: No
Instructions:
No official patch. Migrate from email.utils.parseaddr() to email.parser.BytesParser or email.parser.Parser as recommended in Python documentation.
🔧 Temporary Workarounds
Migrate to email.parser
allReplace usage of legacy email.utils.parseaddr() with the recommended email.parser classes
Input validation and length limits
allImplement input validation and reasonable length limits on email address fields before passing to parseaddr()
🧯 If You Can't Patch
- Implement strict input validation and length limits on all email address inputs
- Wrap parseaddr() calls in try-except blocks to catch RecursionError and handle gracefully
🔍 How to Verify
Check if Vulnerable:
Check Python code for usage of email.utils.parseaddr() function with user-supplied inputCheck Version:
python --versionVerify Fix Applied:
Verify code has been migrated to email.parser classes or implements proper input validation📡 Detection & Monitoring
Log Indicators:
- RecursionError exceptions in application logs
- Application crashes or restarts related to email parsing
Network Indicators:
- Unusually long email address strings in network traffic
SIEM Query:
source="application.logs" AND "RecursionError" AND "parseaddr"🔗 References
- https://docs.python.org/3/library/email.html
- https://docs.python.org/3/library/email.utils.html
- https://github.com/Daybreak2019/PoC_python3.9_Vul/blob/main/RecursionError-email.utils.parseaddr.py
- https://github.com/python/cpython/issues/103800
- https://docs.python.org/3/library/email.html
- https://docs.python.org/3/library/email.utils.html
- https://github.com/Daybreak2019/PoC_python3.9_Vul/blob/main/RecursionError-email.utils.parseaddr.py
- https://github.com/python/cpython/issues/103800
