Skip to content
Appaloosa Scout

Vulnerability · NVD

CVE-2019-16056

HIGH 7.5

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Attack vector : Network No privileges required No user interaction
Show raw CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS 5.37% above median percentile 91.9%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

NVD references 10 distinct products for this CVE — only those tracked by Scout (mobile and desktop catalog apps) are listed above. Libraries, servers and out-of-scope products do not appear here. Full list on NVD ↗

Vulnerable CPE configurations (9)
Vendor Product Versions
python python
All platforms (wildcard)
 ≤2.7.16
python python
All platforms (wildcard)
 ≥3.0.0 ≤3.0.1
python python
All platforms (wildcard)
 ≥3.1.0 ≤3.1.5
python python
All platforms (wildcard)
 ≥3.2.0 ≤3.2.6
python python
All platforms (wildcard)
 ≥3.3.0 ≤3.3.7
python python
All platforms (wildcard)
 ≥3.4.0 ≤3.4.10
python python
All platforms (wildcard)
 ≥3.5.0 ≤3.5.7
python python
All platforms (wildcard)
 ≥3.6.0 ≤3.6.9
python python
All platforms (wildcard)
 ≥3.7.0 ≤3.7.4
View on NVD ↗ Advisory · bugs.python.org Advisory · github.com Advisory · www.oracle.com