Vulnerability · Published Jul 7, 2024 · Assigned by @huntr_ai
CVE-2024-3651Denial of Service via Quadratic Complexity in kjd/idna
Medium 6.2
In plain English
A medium-severity regular-expression denial of service in kjd/idna from kjd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)6.2Medium
Exploit odds (30 days)1.4%top 27.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | python3-idna | 2.5-7.el8_10 | ALSA-2024:4260 |
| AlmaLinux:9 | python3-idna | 2.10-7.el9_4.1 | ALSA-2024:3846 |
| AlmaLinux:8 | python39 | 3.9.19-1.module_el8.10.0+3849+a48d89aa | ALSA-2024:3466 |
| AlmaLinux:8 | python39-Cython | 0.29.21-5.module_el8.6.0+3248+c431e88c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-Cython | 0.29.21-5.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-PyMySQL | 0.10.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-attrs | 20.3.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-cffi | 1.14.3-2.module_el8.6.0+3248+c431e88c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-cffi | 1.14.3-2.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-chardet | 3.0.4-19.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-cryptography | 3.3.1-3.module_el8.10.0+3765+2f9a457d | ALSA-2024:3466 |
| AlmaLinux:8 | python39-debug | 3.9.19-1.module_el8.10.0+3849+a48d89aa | ALSA-2024:3466 |
| AlmaLinux:8 | python39-devel | 3.9.19-1.module_el8.10.0+3849+a48d89aa | ALSA-2024:3466 |
| AlmaLinux:8 | python39-idle | 3.9.19-1.module_el8.10.0+3849+a48d89aa | ALSA-2024:3466 |
| AlmaLinux:8 | python39-idna | 2.10-4.module_el8.10.0+3849+a48d89aa | ALSA-2024:3466 |
| AlmaLinux:8 | python39-iniconfig | 1.1.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-libs | 3.9.19-1.module_el8.10.0+3849+a48d89aa | ALSA-2024:3466 |
| AlmaLinux:8 | python39-lxml | 4.6.5-1.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-lxml | 4.6.5-1.module_el8.6.0+3248+c431e88c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-mod_wsgi | 4.7.1-7.module_el8.9.0+3634+fb2a896c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-more-itertools | 8.5.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-numpy | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-numpy | 1.19.4-3.module_el8.6.0+3248+c431e88c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-numpy-doc | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-numpy-f2py | 1.19.4-3.module_el8.6.0+3248+c431e88c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-numpy-f2py | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-packaging | 20.4-4.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pip | 20.2.4-9.module_el8.10.0+3765+2f9a457d | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pip-wheel | 20.2.4-9.module_el8.10.0+3765+2f9a457d | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pluggy | 0.13.1-3.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-ply | 3.11-10.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-psutil | 5.8.0-4.module_el8.6.0+3248+c431e88c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-psutil | 5.8.0-4.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-psycopg2 | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2024:3466 |
| AlmaLinux:8 | python39-psycopg2-doc | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2024:3466 |
| AlmaLinux:8 | python39-psycopg2-tests | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2024:3466 |
| AlmaLinux:8 | python39-py | 1.10.0-1.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pybind11 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pybind11 | 2.7.1-1.module_el8.6.0+3248+c431e88c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pybind11-devel | 2.7.1-1.module_el8.6.0+3248+c431e88c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pybind11-devel | 2.7.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pycparser | 2.20-3.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pyparsing | 2.4.7-5.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pysocks | 1.7.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pytest | 6.0.2-2.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pyyaml | 5.4.1-1.module_el8.6.0+3248+c431e88c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-pyyaml | 5.4.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-requests | 2.25.0-3.module_el8.9.0+3634+fb2a896c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-rpm-macros | 3.9.19-1.module_el8.10.0+3849+a48d89aa | ALSA-2024:3466 |
| AlmaLinux:8 | python39-scipy | 1.5.4-5.module_el8.9.0+3634+fb2a896c | ALSA-2024:3466 |
| AlmaLinux:8 | python39-setuptools | 50.3.2-5.module_el8.10.0+3765+2f9a457d | ALSA-2024:3466 |
| AlmaLinux:8 | python39-setuptools-wheel | 50.3.2-5.module_el8.10.0+3765+2f9a457d | ALSA-2024:3466 |
| AlmaLinux:8 | python39-six | 1.15.0-3.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-test | 3.9.19-1.module_el8.10.0+3849+a48d89aa | ALSA-2024:3466 |
| AlmaLinux:8 | python39-tkinter | 3.9.19-1.module_el8.10.0+3849+a48d89aa | ALSA-2024:3466 |
| AlmaLinux:8 | python39-toml | 0.10.1-5.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-urllib3 | 1.25.10-5.module_el8.10.0+3765+2f9a457d | ALSA-2024:3466 |
| AlmaLinux:8 | python39-wcwidth | 0.2.5-3.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-wheel | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| AlmaLinux:8 | python39-wheel-wheel | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2024:3466 |
| Alpine:v3.20 | py3-idna | 3.7-r0 | ALPINE-CVE-2024-3651 |
| Alpine:v3.21 | py3-idna | 3.7-r0 | ALPINE-CVE-2024-3651 |
| Alpine:v3.22 | py3-idna | 3.7-r0 | ALPINE-CVE-2024-3651 |
| Alpine:v3.23 | py3-idna | 3.7-r0 | ALPINE-CVE-2024-3651 |
| Alpine:v3.24 | py3-idna | 3.7-r0 | ALPINE-CVE-2024-3651 |
| Debian:12 | python-idna | 3.3-1+deb12u1 | DEBIAN-CVE-2024-3651 |
| Debian:13 | python-idna | 3.6-2.1 | DEBIAN-CVE-2024-3651 |
| Debian:14 | python-idna | 3.6-2.1 | DEBIAN-CVE-2024-3651 |
| PyPI | idna | 3.7 | PYSEC-2024-60 |
| PyPI | idna | 3.7 | GHSA-jjg7-2v4v-x38h |
| Rocky Linux:8 | python-idna | 0:2.5-7.el8_10 | RLSA-2024:4260 |
| Rocky Linux:9 | python-idna | 0:2.10-7.el9_4.1 | RLSA-2024:3846 |
| Ubuntu:22.04:LTS | python-idna | 3.3-1ubuntu0.1 | USN-6780-1 |
| Ubuntu:22.04:LTS | python-idna | 3.3-1ubuntu0.1 | UBUNTU-CVE-2024-3651 |
| Ubuntu:24.04:LTS | python-idna | 3.6-2ubuntu0.1 | UBUNTU-CVE-2024-3651 |
| Ubuntu:24.04:LTS | python-idna | 3.6-2ubuntu0.1 | USN-6780-1 |
| Ubuntu:22.04:LTS | python-pip | 22.0.2+dfsg-1ubuntu0.7 | USN-7762-1 |
| Ubuntu:22.04:LTS | python-pip | 22.0.2+dfsg-1ubuntu0.7 | UBUNTU-CVE-2024-3651 |
| Ubuntu:24.04:LTS | python-pip | 24.0+dfsg-1ubuntu1.3 | UBUNTU-CVE-2024-3651 |
| Ubuntu:24.04:LTS | python-pip | 24.0+dfsg-1ubuntu1.3 | USN-7762-1 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb
- https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d
- https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2/