Log in Start free

Vulnerability · Published Apr 11, 2024 · Assigned by mitre

CVE-2023-29483

High 7.0

In plain English

A high-severity security flaw in the python3-dns package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)1.9%top 20.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8python3-dns1.15.0-12.el8_10ALSA-2024:3275
AlmaLinux:9python3-dns2.6.1-3.el9ALSA-2024:9423
Debian:12dnspythonno fix listedDEBIAN-CVE-2023-29483
Debian:13dnspython2.6.0-1DEBIAN-CVE-2023-29483
Debian:14dnspython2.6.0-1DEBIAN-CVE-2023-29483
PyPIdnspython2.6.1PYSEC-2026-1307
PyPIdnspython2.6.1GHSA-3rq5-2g8h-59hc
PyPIeventlet0.35.2PYSEC-2026-2472
PyPIeventlet0.35.2GHSA-3rq5-2g8h-59hc
Rocky Linux:8python-dns0:1.15.0-12.el8_10RLSA-2024:3275
Rocky Linux:9python-dns0:2.6.1-3.el9RLSA-2024:9423
Ubuntu:22.04:LTSdnspythonno fix listedUBUNTU-CVE-2023-29483

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-292 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

References