You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Reject control characters in POP3 commands #143923
Hi, thanks for fixing this. The fix in GH-143924 only landed on main, so every 3.10 to 3.14 release is still flagged for CVE-2025-15367 by security scanners (VuXML lists them all as affected).
I backported it to 3.13 and tested it against the 3.13.16 standard library. test_poplib passes, going from 71 tests to 74 with the new test, and a quick check shows the old code sends "USER bob\r\nDELE 1" as two commands while the patched code raises ValueError. The only difference from the original change is where the new test import goes, since the 3.13 test_poplib imports are a little different. control_characters_c0() already exists in 3.13's test.support, so nothing else is needed there.
I'm not going to sign the contributor agreement, so I won't open a backport PR myself, but here is the patch in case one of you wants to pick it up:
--- a/Lib/poplib.py+++ b/Lib/poplib.py@@ -122,6 +122,8 @@
def _putcmd(self, line):
if self._debugging: print('*cmd*', repr(line))
line = bytes(line, self.encoding)
+ if re.search(b'[\x00-\x1F\x7F]', line):+ raise ValueError('Control characters not allowed in commands')
self._putline(line)
--- a/Lib/test/test_poplib.py+++ b/Lib/test/test_poplib.py@@ -17,6 +17,7 @@
from test.support import threading_helper
from test.support import asynchat
from test.support import asyncore
+from test.support import control_characters_c0
from test.support.testcase import ExtraAssertions
@@ -396,6 +397,13 @@
self.assertIsNone(self.client.sock)
self.assertIsNone(self.client.file)
+ def test_control_characters(self):+ for c0 in control_characters_c0():+ with self.assertRaises(ValueError):+ self.client.user(f'user{c0}')+ with self.assertRaises(ValueError):+ self.client.pass_(f'{c0}pass')+
@requires_ssl
def test_stls_capa(self):
capa = self.client.capa()
--- /dev/null+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst@@ -0,0 +1 @@+Reject control characters in POP3 commands.
Activity
pythongh-143923: Reject control characters in POP3 commands
gh-143923: Reject control characters in POP3 commands
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
Update python314 to version 3.14.3 / rev 32 via SR 1332989
15 remaining items
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
[CVE-2025-15367] Add 'test.support' fixture for C0 control characters
[CVE-2025-15367] Add 'test.support' fixture for C0 control characters
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
00475: CVE-2025-15367
pythongh-143923: Reject control characters in POP3 commands
pythongh-143923: Reject control characters in POP3 commands
pythongh-143923: Reject control characters in POP3 commands
pythongh-143923: Reject control characters in POP3 commands
mobilevoid commentedon Nov 2, 2026
Hi, thanks for fixing this. The fix in GH-143924 only landed on main, so every 3.10 to 3.14 release is still flagged for CVE-2025-15367 by security scanners (VuXML lists them all as affected).
I backported it to 3.13 and tested it against the 3.13.16 standard library. test_poplib passes, going from 71 tests to 74 with the new test, and a quick check shows the old code sends "USER bob\r\nDELE 1" as two commands while the patched code raises ValueError. The only difference from the original change is where the new test import goes, since the 3.13 test_poplib imports are a little different. control_characters_c0() already exists in 3.13's test.support, so nothing else is needed there.
I'm not going to sign the contributor agreement, so I won't open a backport PR myself, but here is the patch in case one of you wants to pick it up:
Thanks again.