CVE-2023-36632 Denial of service in n/a
Attackers can cause a denial of service via recursion error in Python's legacy email parsing function using crafted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-36632?
CVE-2023-36632 is a high-severity denial of service vulnerability in Python Python, published on 25 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.
Weakness: CWE-674
Which versions are affected by CVE-2023-36632?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.11.5 |
python Bitnami | All versions | 3.11.5 |
python-min Bitnami | All versions | 3.11.5 |
Products include Python Python.
How do I fix CVE-2023-36632?
Upgrade libpython to 3.11.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-36632 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36632 exists.
Other vulnerabilities in Python Python
Sources
Also known as AZL-109665, BIT-libpython-2023-36632, BIT-python-2023-36632, BIT-python-min-2023-36632, ECHO-f330-0e36-0681, GHSA-gv66-v8c8-v69c and 2 more.