This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author xtreak
Recipients barry, bortzmeyer, cnicodeme, jwilk, kal.sze, msapiro, r.david.murray, vstinner, xtreak
Date 2019-04-19.10:28:43
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
Relevant attack from matrix blog post.

> sydent uses python's email.utils.parseaddr function to parse the input email address before sending validation mail to it, but it turns out that if you hand parseaddr an malformed email address of form, it silently discards the prefix without error. The result of this is that if one requested a validation token for '', the token would be sent to '', but the address '' would be marked as validated. This release fixes this behaviour by asserting that the parsed email address is the same as the input email address.

I am marking this as a security issue.
Date User Action Args
2019-04-19 10:28:43xtreaksetrecipients: + xtreak, barry, vstinner, msapiro, jwilk, r.david.murray, kal.sze, cnicodeme, bortzmeyer
2019-04-19 10:28:43xtreaksetmessageid: <>
2019-04-19 10:28:43xtreaklinkissue34155 messages
2019-04-19 10:28:43xtreakcreate