CVE-2024-6923

Name	CVE-2024-6923
Description	There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python2.7 (PTS)	bullseye	2.7.18-8+deb11u1	vulnerable
python3.11 (PTS)	bookworm	3.11.2-6+deb12u2	vulnerable
	bookworm (security)	3.11.2-6+deb12u3	vulnerable
python3.12 (PTS)	sid, trixie	3.12.6-1	fixed
python3.13 (PTS)	sid, trixie	3.13.0~rc2-1	fixed
python3.9 (PTS)	bullseye	3.9.2-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
python2.7	source	(unstable)	(unfixed)
python3.11	source	(unstable)	(unfixed)
python3.12	source	(unstable)	3.12.5-1
python3.13	source	(unstable)	3.13.0~rc2-1
python3.9	source	(unstable)	(unfixed)

Notes

[bookworm] - python3.11 <postponed> (Minor issue, wait until merged into 3.11 branch)
[bullseye] - python3.9 <no-dsa> (Minor issue)
[bullseye] - python2.7 <ignored> (Unsupported in Bullseye, only included to build a few applications)
https://github.com/python/cpython/issues/121650
https://github.com/python/cpython/pull/122233
https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0 (v3.13.0rc2)
https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7 (v3.12.5)
https://github.com/python/cpython/commit/f7c0f09e69e950cf3c5ada9dbde93898eb975533 (v3.11.10)
https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147 (v3.10.15)
https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6 (v3.9.20)