Moderate Security Vulnerability in Python 3.12: IMAP and POP3 Command Injection
Summary
ALSA-2026:4165: Moderate: python3.12 security update. Affects python3.12 versions < 3.12.12-4.el9_7.1. Fixed in 3.12.12-4.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports various system calls and libraries, making it a versatile choice for developers. It includes features like modules, classes, exceptions, and dynamic data types. However, recent security findings have revealed vulnerabilities in its IMAP and POP3 functionalities, which could allow malicious actors to exploit user-controlled commands.
Vulnerability Detail
The vulnerabilities identified in Python 3.12 include an IMAP command injection (CVE-2025-15366) and a POP3 command injection (CVE-2025-15367). These vulnerabilities arise from improper handling of user-controlled commands, which could lead to unauthorized command execution. Additionally, there is an email header injection issue (CVE-2026-1299) due to unquoted newlines, which could allow attackers to manipulate email headers, potentially leading to phishing attacks or other malicious activities.
How To Fix
Minimum fixed version
3.12.12-4.el9_7.1
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user-controlled commands in IMAP and POP3 functionalities until the update is applied. Implement input validation to sanitize user inputs and prevent command injection.
Conclusion
In summary, Python 3.12 has been found to have moderate security vulnerabilities related to IMAP and POP3 command injections, as well as email header injection. It is crucial to update to the latest patched version to mitigate these risks. For those unable to update immediately, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include IMAP and POP3 command injection and email header injection due to unquoted newlines.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The impact includes potential unauthorized command execution and manipulation of email headers, which can lead to phishing attacks.
Yes, a patch is available in version 3.12.12-4.el9_7.1. It is recommended to update to this version.
If you cannot update immediately, implement input validation to sanitize user inputs and avoid using user-controlled commands in IMAP and POP3 functionalities.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
