Bug 1212717 (CVE-2023-36632)

Summary:	VUL-1: DISPUTED: CVE-2023-36632: python39,python3,python36,python311,python,python310: unbounded recursion when using the legacy email.utils.parseaddr() function with untrusted input
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Carlos López <carlos.lopez>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED WONTFIX	QA Contact:	Security Team bot <security-team>
Severity:	Minor
Priority:	P4 - Low	CC:	mcepl, meissner, rfrohl, security-team, stoyan.manolov, zkuahxv
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/370459/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-36632:3.1:(AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Carlos López 2023-06-26 08:56:45 UTC

CVE-2023-36632

The legacy email.utils.parseaddr function in Python through 3.11.4 allows
attackers to trigger "RecursionError: maximum recursion depth exceeded while
calling a Python object" via a crafted argument. This argument is plausibly an
untrusted value from an application's input data that was supposed to contain a
name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a
Legacy API in the documentation of the Python email package. Applications should
instead use the email.parser.BytesParser or email.parser.Parser class.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-36632
https://bugzilla.redhat.com/show_bug.cgi?id=2217338
https://www.cve.org/CVERecord?id=CVE-2023-36632
http://www.cvedetails.com/cve/CVE-2023-36632/
https://docs.python.org/3/library/email.html
https://docs.python.org/3/library/email.utils.html
https://github.com/Daybreak2019/PoC_python3.9_Vul/blob/main/RecursionError-email.utils.parseaddr.py

Comment 1 Matej Cepl 2023-07-03 11:14:41 UTC

I completely agree with Petr Viktorin from Red Hat:

> What makes this a security issue? The function can raise AttributeError, LookupError, OSError, TypeError, UnicodeEncodeError, ValueError, or really any type of error. RecursionError is unexpected, but why is it treated as a *security* issue.

Upstream ticket is https://github.com/python/cpython/issues/103800 but it heavily disputed whether it is even bug at all, not talking whether it is a *security* bug.

Comment 3 khanh vu 2023-09-13 06:25:56 UTC

Hi All,

Is there any updated information on this ticket?
I saw that https://www.suse.com/security/cve/CVE-2023-36632.html is still pending.
Will we close it or continue to wait for the upstream fix?

BRs/KhanhVu