Spyder 6.0.x uses a vulnerable Python implementation

[bedwinc]

Issue Report Checklist

• Searched the issues page for similar reports
• Read the relevant sections of the Spyder Troubleshooting Guide and followed its advice
• Reproduced the issue after updating with conda update spyder (or pip, if not using Anaconda)
• Could not reproduce inside jupyter qtconsole (if console-related)
• Tried basic troubleshooting (if a bug/error)
  • Restarted Spyder
  • Reset preferences with spyder --reset
  • Reinstalled the latest version of Anaconda
  • Tried the other applicable steps from the Troubleshooting Guide
• Completed the Problem Description, Steps to Reproduce and Version sections below

Problem Description

Spyder v6.0.3 is using a vulnerable version of Python according to Qualys. https://nvd.nist.gov/vuln/detail/CVE-2023-27043

Vulnerability Result
Location: C:\ProgramData\spyder-6\include\patchlevel.h
Version: 3.11.9
HKLM\SOFTWARE\Python\PythonCore\3.11\INSTALLPATH Key found

The e-mail module of Python 0 - 2.7.18, 3.x - 3.12.x incorrectly parses e-mail addresses which contain a special character. This vulnerability allows attackers to send messages from e-mail addresses that would otherwise be rejected.

Affected versions
Python version 0 to 3.8.19
Python version 3.9.0 to 3.9.19
Python version 3.10.0 to 3.10.14
Python version 3.11.0 to 3.11.9
Python version 3.12.0 to 3.12.5

What steps reproduce the problem?

1. Update Spyder to v 6.0.3

What is the expected output? What do you see instead?

N/A

Paste Traceback/Error Below (if applicable)

PASTE TRACEBACK HERE

Versions

• Spyder version:
• Python version:
• Qt version:
• PyQt version:
• Operating System name/version:

Dependencies

PASTE DEPENDENCIES HERE

[ccordoba12]

Hey @bedwinc, thanks for reporting. We'll address this in our 6.1 version, to be released in a few months.

Since Spyder is not used for general development but mostly for scientific programming, we're not too worried about a vulnerability in the email module of the standard library,

[bedwinc]

Thank you for the information.

…

On Fri, Jan 3, 2025 at 9:48 AM Carlos Cordoba ***@***.***> wrote: Hey @bedwinc <https://github.com/bedwinc>, thanks for reporting. We'll address this in our 6.1 version, to be released in a few months. Since Spyder is not used for general development but mostly for scientific programming, we're not too worried about a vulnerability in the email module of the standard library, — Reply to this email directly, view it on GitHub <#23396 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BOEM3SD7FIT3I7L7GBMA55D2I25MLAVCNFSM6AAAAABUQGW3UKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNRZGUZDMNBZGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>