Summary
eml_parser uses the email.utils.getaddresses() function from the CPython standard library to parse e-mail headers that contain e-mail addresses (such as To, Cc, Bcc, From, Reply-To, Sender, ...). When the input header contains a deeply nested CFWS (comment / folding white space) construct, the recursive descent parser in the standard library exhausts the call stack. The resulting RecursionError is not caught by eml_parser, so the exception propagates and aborts parsing of the whole message.
Impact
SOC pipelines use eml_parser to process untrusted e-mails. An attacker can easily create an eml file that will trigger the RecursionError during parsing.
The impact is mitigated by the fact that there are various other situations in which eml_parser will raise an exception when attempting to parse a malformed or pathological eml file. In particular, very deeply nested multipart e-mails also result in a RecursionError being raised by the library voluntarily. Therefore, systems relying on eml_parser already need to detect and handle errors emanating from the library in an appropriate way.
Workarounds
The issue can be avoided by wrapping the call to eml_parser.decode_email or eml_parser.decode_email_bytes in a try/except construct.
Patches
Since version 3.0.2, eml_parser will catch the error in the standard library parser and fall back to a simpler parser based on a regular expression.
References
Sebasteuo Reporter
Summary
eml_parseruses theemail.utils.getaddresses()function from the CPython standard library to parse e-mail headers that contain e-mail addresses (such asTo,Cc,Bcc,From,Reply-To,Sender, ...). When the input header contains a deeply nested CFWS (comment / folding white space) construct, the recursive descent parser in the standard library exhausts the call stack. The resultingRecursionErroris not caught byeml_parser, so the exception propagates and aborts parsing of the whole message.Impact
SOC pipelines use
eml_parserto process untrusted e-mails. An attacker can easily create an eml file that will trigger theRecursionErrorduring parsing.The impact is mitigated by the fact that there are various other situations in which
eml_parserwill raise an exception when attempting to parse a malformed or pathological eml file. In particular, very deeply nested multipart e-mails also result in aRecursionErrorbeing raised by the library voluntarily. Therefore, systems relying oneml_parseralready need to detect and handle errors emanating from the library in an appropriate way.Workarounds
The issue can be avoided by wrapping the call to
eml_parser.decode_emailoreml_parser.decode_email_bytesin atry/exceptconstruct.Patches
Since version 3.0.2,
eml_parserwill catch the error in the standard library parser and fall back to a simpler parser based on a regular expression.References