File CVE-2025-15366-imap-ctrl-chars.patch of Package python3.42754
From 7485ee5e2cf81d3e5ad0d9c3be73cecd2ab4eec7 Mon Sep 17 00:00:00 2001
From: Seth Michael Larson <seth@python.org>
Date: Fri, 16 Jan 2026 10:54:09 -0600
Subject: [PATCH 1/2] Add 'test.support' fixture for C0 control characters
---
Lib/imaplib.py | 3 +++
Lib/test/test_imaplib.py | 10 +++++++++-
Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 +
3 files changed, 13 insertions(+), 1 deletion(-)
Index: Python-3.4.10/Lib/imaplib.py
===================================================================
--- Python-3.4.10.orig/Lib/imaplib.py 2019-03-18 17:51:26.000000000 +0100
+++ Python-3.4.10/Lib/imaplib.py 2026-02-12 18:54:46.338711531 +0100
@@ -113,6 +113,7 @@
Untagged_response = re.compile(br'\* (?P<type>[A-Z-]+)( (?P<data>.*))?')
Untagged_status = re.compile(
br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?', re.ASCII)
+_control_chars = re.compile(b'[\x00-\x1F\x7F]')
@@ -896,6 +897,8 @@
if arg is None: continue
if isinstance(arg, str):
arg = bytes(arg, "ASCII")
+ if _control_chars.search(arg):
+ raise ValueError("Control characters not allowed in commands")
data = data + b' ' + arg
literal = self.literal
Index: Python-3.4.10/Lib/test/test_imaplib.py
===================================================================
--- Python-3.4.10.orig/Lib/test/test_imaplib.py 2019-03-18 17:51:26.000000000 +0100
+++ Python-3.4.10/Lib/test/test_imaplib.py 2026-02-12 18:55:35.106881438 +0100
@@ -11,7 +11,9 @@
import time
import calendar
-from test.support import reap_threads, verbose, transient_internet, run_with_tz, run_with_locale
+from test.support import (reap_threads, verbose, transient_internet,
+ run_with_tz, run_with_locale,
+ control_characters_c0)
import unittest
from datetime import datetime, timezone, timedelta
try:
@@ -484,6 +486,12 @@
self.assertRaises(ValueError, self.imap_class, self.host, self.port,
keyfile=CERTFILE, ssl_context=self.create_ssl_context())
+ def test_control_characters(self):
+ client, _ = self._setup(SimpleIMAPHandler)
+ for c0 in control_characters_c0():
+ with self.assertRaises(ValueError):
+ client.login('user{}'.format(c0), 'pass')
+
def load_tests(*args):
tests = [TestImaplib]
Index: Python-3.4.10/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ Python-3.4.10/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst 2026-02-12 18:52:48.089533621 +0100
@@ -0,0 +1 @@
+Reject control characters in IMAP commands.
