CVE-2025-1795
Low
Description
During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.
SeverityLow
CVSS2.3
Exploit probability—
ProductCPython
PublishedFeb 28, 2025
First seenFeb 28, 2025
Weakness typeCWE-116CWE-116
How to fix
Update
- Python Software Foundation CPython3.9.23, 3.10.17, 3.11.9, 3.12.3, 3.13.0a5 or later
Patches
- github.com/python/cpython/pull/100885
- github.com/python/cpython/pull/119099
- github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48
- github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593
- github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74
- github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d
- github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.9.23, 3.10.0 ≤ v < 3.10.17, 3.11.0 ≤ v < 3.11.9, 3.12.0 ≤ v < 3.12.3, 3.13.0a1 ≤ v < 3.13.0a5 | 3.9.23, 3.10.17, 3.11.9, 3.12.3, 3.13.0a5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.