© 2026 vulntracker.io

CVE-2023-27043

MEDIUM

5.3

CVSS Score

Published: April 18, 2023 at 12:00 AM UTC

Updated: June 17, 2026 at 05:44 AM UTC

15 products affected across 4 vendorsFedoraActive IQ Unified ManagerPython

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 3%

SSVC

PoC

Description

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Fedora · Fedora Projectrpm

95%

Active IQ Unified Manager · NetAppnpm

95%

All versions

ONTAP Select Deploy administration utility · NetApp

95%

All versions

Python · Python

95%

v ≤ 2.7.183.0 ≤ v < 3.8.203.10.0 ≤ v < 3.10.153.11.0 ≤ v < 3.11.103.12.0 ≤ v < 3.12.63.9.0 ≤ v < 3.9.20

Affected range stops below 3.10.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.11.10, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.12.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.8.20, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.9.20, so it looks safe — our inference, not a vendor statement

RUGGEDCOM Rox MX5000 Firmware · Siemens

60%

v < V2.17.0v < V2.17.1

Affected range stops below V2.17.0, so it looks safe — our inference, not a vendor statement

Affected range stops below V2.17.1, so it looks safe — our inference, not a vendor statement

RUGGEDCOM Rox MX5000RE Firmware · Siemens

60%

v < V2.17.0v < V2.17.1

Affected range stops below V2.17.0, so it looks safe — our inference, not a vendor statement

Affected range stops below V2.17.1, so it looks safe — our inference, not a vendor statement

RUGGEDCOM Rox RX1400 Firmware · Siemens

60%

v < V2.17.0v < V2.17.1

Affected range stops below V2.17.0, so it looks safe — our inference, not a vendor statement

Affected range stops below V2.17.1, so it looks safe — our inference, not a vendor statement

RUGGEDCOM Rox RX1500 Firmware · Siemens

60%

v < V2.17.0v < V2.17.1

Affected range stops below V2.17.0, so it looks safe — our inference, not a vendor statement

Affected range stops below V2.17.1, so it looks safe — our inference, not a vendor statement

RUGGEDCOM Rox RX1501 Firmware · Siemens

60%

v < V2.17.0v < V2.17.1

Affected range stops below V2.17.0, so it looks safe — our inference, not a vendor statement

Affected range stops below V2.17.1, so it looks safe — our inference, not a vendor statement

RUGGEDCOM Rox RX1510 Firmware · Siemens

60%

v < V2.17.0v < V2.17.1

Affected range stops below V2.17.0, so it looks safe — our inference, not a vendor statement

Affected range stops below V2.17.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (46)

Vendor Advisory

Source: [email protected]

http://python.org

ExploitIssue Tracking

Source: [email protected]

https://github.com/python/cpython/issues/102988

Vendor AdvisoryThird Party Advisory

Source: [email protected]

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/

Vendor AdvisoryThird Party Advisory

Source: [email protected]

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/

Vendor AdvisoryThird Party Advisory

Source: [email protected]

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/

Vendor AdvisoryThird Party Advisory

Source: [email protected]

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/

Vendor AdvisoryThird Party Advisory

Source: [email protected]

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/

Vendor AdvisoryThird Party Advisory

Source: [email protected]

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/

SSVC — Action Prioritization

SSVCPoCAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.3MEDIUMCISA-ADP

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: LOW
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-20

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card