62 lines
2.4 KiB
Diff
62 lines
2.4 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Seth Michael Larson <seth@python.org>
|
|
Date: Tue, 20 Jan 2026 14:45:42 -0600
|
|
Subject: 00474: CVE-2025-15366
|
|
|
|
gh-143921: Reject control characters in IMAP commands
|
|
|
|
(cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
|
|
---
|
|
Lib/imaplib.py | 4 +++-
|
|
Lib/test/test_imaplib.py | 6 ++++++
|
|
.../Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 +
|
|
3 files changed, 10 insertions(+), 1 deletion(-)
|
|
create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
|
|
|
|
diff --git a/Lib/imaplib.py b/Lib/imaplib.py
|
|
index 67b2cc02c4..abd530e98b 100644
|
|
--- a/Lib/imaplib.py
|
|
+++ b/Lib/imaplib.py
|
|
@@ -128,7 +128,7 @@ Untagged_status = re.compile(
|
|
# We compile these in _mode_xxx.
|
|
_Literal = br'.*{(?P<size>\d+)}$'
|
|
_Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
|
|
-
|
|
+_control_chars = re.compile(b'[\x00-\x1F\x7F]')
|
|
|
|
|
|
class IMAP4:
|
|
@@ -958,6 +958,8 @@ class IMAP4:
|
|
if arg is None: continue
|
|
if isinstance(arg, str):
|
|
arg = bytes(arg, self._encoding)
|
|
+ if _control_chars.search(arg):
|
|
+ raise ValueError("Control characters not allowed in commands")
|
|
data = data + b' ' + arg
|
|
|
|
literal = self.literal
|
|
diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py
|
|
index 0593a3756b..ec95577e96 100644
|
|
--- a/Lib/test/test_imaplib.py
|
|
+++ b/Lib/test/test_imaplib.py
|
|
@@ -462,6 +462,12 @@ class NewIMAPTestsMixin():
|
|
self.assertEqual(data[0], b'LOGIN completed')
|
|
self.assertEqual(client.state, 'AUTH')
|
|
|
|
+ def test_control_characters(self):
|
|
+ client, _ = self._setup(SimpleIMAPHandler)
|
|
+ for c0 in support.control_characters_c0():
|
|
+ with self.assertRaises(ValueError):
|
|
+ client.login(f'user{c0}', 'pass')
|
|
+
|
|
def test_logout(self):
|
|
client, _ = self._setup(SimpleIMAPHandler)
|
|
typ, data = client.login('user', 'pass')
|
|
diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
|
|
new file mode 100644
|
|
index 0000000000..4e13fe92bc
|
|
--- /dev/null
|
|
+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
|
|
@@ -0,0 +1 @@
|
|
+Reject control characters in IMAP commands.
|