Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0zcnE1LTJnOGgtNTloY84AA67c
Potential DoS via the Tudoor mechanism in eventlet and dnspython
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
Permalink: https://github.com/advisories/GHSA-3rq5-2g8h-59hcJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcnE1LTJnOGgtNTloY84AA67c
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 22 days ago
Updated: 20 days ago
CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Identifiers: GHSA-3rq5-2g8h-59hc, CVE-2023-29483
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-29483
- https://github.com/eventlet/eventlet/issues/913
- https://github.com/rthalley/dnspython/issues/1045
- https://github.com/eventlet/eventlet/releases/tag/v0.35.2
- https://github.com/rthalley/dnspython/releases/tag/v2.6.0
- https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713
- https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4
- https://github.com/rthalley/dnspython/commit/0ea5ad0a4583e1f519b9bcc67cfac381230d9cf2
- https://github.com/advisories/GHSA-3rq5-2g8h-59hc
Blast Radius: 27.5
Affected Packages
pypi:dnspython
Dependent packages: 449Dependent repositories: 46,555
Downloads: 38,451,998 last month
Affected Version Ranges: < 2.6.1
Fixed in: 2.6.1
All affected versions: 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.4.0, 1.5.0, 1.6.0, 1.7.1, 1.8.0, 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.10.0, 1.11.0, 1.11.1, 1.12.0, 1.13.0, 1.14.0, 1.15.0, 1.16.0, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.6.0
All unaffected versions: 2.6.1
pypi:eventlet
Dependent packages: 194Dependent repositories: 10,833
Downloads: 1,442,428 last month
Affected Version Ranges: < 0.35.2
Fixed in: 0.35.2
All affected versions: 0.5.3, 0.6.1, 0.8.16, 0.9.17, 0.10.0, 0.11.0, 0.12.1, 0.13.0, 0.14.0, 0.15.2, 0.16.1, 0.17.4, 0.18.2, 0.18.3, 0.18.4, 0.19.0, 0.20.0, 0.20.1, 0.21.0, 0.22.0, 0.22.1, 0.23.0, 0.24.0, 0.24.1, 0.25.0, 0.25.1, 0.25.2, 0.26.0, 0.26.1, 0.27.0, 0.28.0, 0.28.1, 0.29.0, 0.29.1, 0.30.0, 0.30.1, 0.30.2, 0.30.3, 0.31.0, 0.31.1, 0.32.0, 0.33.0, 0.33.1, 0.33.2, 0.33.3, 0.34.1, 0.34.2, 0.34.3, 0.35.0, 0.35.1
All unaffected versions: 0.35.2, 0.36.0, 0.36.1