Moderate Security Vulnerability in Python 3.12: IMAP and POP3 Command Injection
Summary
RLSA-2026:4165: Moderate: python3.12 security update. Affects python3.12 versions < 0:3.12.12-4.el9_7.1. Fixed in 0:3.12.12-4.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. It is widely used for various applications due to its versatility and ease of use. However, recent vulnerabilities have been identified that could potentially compromise the security of applications utilizing this version.
Vulnerability Detail
The vulnerabilities in Python 3.12 include command injection flaws in the IMAP and POP3 protocols, which can be exploited through user-controlled commands. Specifically, CVE-2025-15366 allows for IMAP command injection, while CVE-2025-15367 pertains to POP3 command injection. Additionally, CVE-2026-1299 highlights an email header injection issue caused by unquoted newlines. These vulnerabilities can lead to unauthorized access and manipulation of email communications, posing significant risks to data integrity and confidentiality.
How To Fix
Minimum fixed version
0:3.12.12-4.el9_7.1
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using user-controlled commands in IMAP and POP3 operations until the package is updated. Implement input validation to sanitize user inputs and prevent command injection.
Conclusion
The identified vulnerabilities in Python 3.12 pose significant risks to applications utilizing this version. It is crucial to update to the latest patched version to ensure security and protect against potential exploits. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
The CVSS score for this vulnerability is 7.1, indicating a moderate level of severity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of these vulnerabilities can lead to unauthorized access to email accounts, manipulation of email content, and potential data breaches.
Yes, updating to version 3.12.12-4.el9_7.1 or later will mitigate these vulnerabilities.
If immediate updates are not possible, implement input validation and avoid using user-controlled commands in email operations as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
