The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| F5 Big Ip | — | — | May 24, 2024 | Sep 2, 2016 |
| Oracle Missing Cpu Apr 2024 | — | Apply the April 2024 Critical Patch Update (CPU) for Oracle Database | Apr 25, 2024 | Jun 25, 2023 |
| Rapid7 Insightagent | — | Upgrade Rapid7 Insight Agent to version 4.0.6.14 | Mar 19, 2024 | Jun 25, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub