CVE-2023-27043

The email module of Python through 3.11.3 incorrectly parses e-mail
addresses that contain a special character. The wrong portion of an RFC2822
header is identified as the value of the addr-spec. In some applications,
an attacker can bypass a protection mechanism in which application access
is granted only after verifying receipt of e-mail to a specific domain
(e.g., only @company.example.com addresses may be used for signup). This
occurs in email/_parseaddr.py in recent versions of Python.

Bugs

• <https://github.com/python/cpython/issues/102988&gt;
• <https://github.com/python/cpython/issues/106669 (regression)>
• <https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html&gt;

Notes