Wind River Support Network

HomeDefectsLIN1021-5980

Acknowledged

LIN1021-5980 : Security Advisory - python - CVE-2023-36632

Created: Jun 25, 2023 Updated: Jun 28, 2023

Found In Version: 10.21.20.1

Severity: Standard

Applicable for: Wind River Linux LTS 21

Component/s: Userspace

Description

The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class.

CREATE(Triage):(User=admin) CVE-2023-36632 (https://nvd.nist.gov/vuln/detail/CVE-2023-36632)