Bug 1212717 (CVE-2023-36632) - VUL-1: DISPUTED: CVE-2023-36632: python39,python3,python36,python311,python,python310: unbounded recursion when using the legacy email.utils.parseaddr() function with untrusted input
Summary: VUL-1: DISPUTED: CVE-2023-36632: python39,python3,python36,python311,python,p...
Status: RESOLVED WONTFIX
Alias: CVE-2023-36632
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/370459/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-36632:3.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-26 08:56 UTC by Carlos López
Modified: 2023-09-13 09:07 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2023-06-26 08:56:45 UTC 
CVE-2023-36632

The legacy email.utils.parseaddr function in Python through 3.11.4 allows
attackers to trigger "RecursionError: maximum recursion depth exceeded while
calling a Python object" via a crafted argument. This argument is plausibly an
untrusted value from an application's input data that was supposed to contain a
name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a
Legacy API in the documentation of the Python email package. Applications should
instead use the email.parser.BytesParser or email.parser.Parser class.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-36632
https://bugzilla.redhat.com/show_bug.cgi?id=2217338
https://www.cve.org/CVERecord?id=CVE-2023-36632
http://www.cvedetails.com/cve/CVE-2023-36632/
https://docs.python.org/3/library/email.html
https://docs.python.org/3/library/email.utils.html
https://github.com/Daybreak2019/PoC_python3.9_Vul/blob/main/RecursionError-email.utils.parseaddr.py
Comment 1 Matej Cepl 2023-07-03 11:14:41 UTC 
I completely agree with Petr Viktorin from Red Hat:

> What makes this a security issue? The function can raise AttributeError, LookupError, OSError, TypeError, UnicodeEncodeError, ValueError, or really any type of error. RecursionError is unexpected, but why is it treated as a *security* issue.

Upstream ticket is https://github.com/python/cpython/issues/103800 but it heavily disputed whether it is even bug at all, not talking whether it is a *security* bug.
Comment 3 khanh vu 2023-09-13 06:25:56 UTC 
Hi All,

Is there any updated information on this ticket?
I saw that https://www.suse.com/security/cve/CVE-2023-36632.html is still pending.
Will we close it or continue to wait for the upstream fix?

BRs/KhanhVu