CVE-2025-1795

Katalog CVE

CVSS 2.3 · Low EPSS 0,63%

Kerentanan Improper Encoding or Escaping of Output. Skor CVSS 4.0 2.3 (Low) menurut python.org.

Deskripsi (NVD)

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.

Rincian

Terbit di NVD

28 Februari 2025

Terakhir diubah

31 Juli 2026

Status NVD

Deferred

CVSS 4.0

2.3 (Low), sumber python.org
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48
• https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593
• https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74
• https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d
• https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090
• https://github.com/python/cpython/issues/100884
• https://github.com/python/cpython/pull/100885
• https://github.com/python/cpython/pull/119099
• https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/
• https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html