Vulnerability GHSA-3rq5-2g8h-59hc
Medium Risk
MEDIUM RISK
CVSS Score: 5.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
2 years ago
April 11, 2024 at 03:30 PM UTC
Potential DoS via the Tudoor mechanism in eventlet and dnspython
1.0.0 - 1.6.0 and 1.7.1 - 2.0.0rc1 and 2.0.0rc2 and 2.0.0 - 2.1.0rc1 and 2.1.0 - 2.2.0rc1 and 2.2.0 - 2.3.0rc1 and 2.3.0 - 2.4.0rc1 and 2.4.0 - 2.5.0rc1 and 2.5.0 - 2.6.0rc1 and 2.6.0
1.0.0 - 1.6.0 and 1.7.1 - 2.0.0rc1 and 2.0.0rc2 and 2.0.0 - 2.1.0rc1 and 2.1.0 - 2.2.0rc1 and 2.2.0 - 2.3.0rc1 and 2.3.0 - 2.4.0rc1 and 2.4.0 - 2.5.0rc1 and 2.5.0 - 2.6.0rc1 and 2.6.0
Summary
Potential DoS via the Tudoor mechanism in eventlet and dnspython
Details
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
References
- ADVISORY — nvd.nist.gov
- WEB — github.com
- WEB — github.com
- WEB — github.com
- WEB — github.com
- PACKAGE — github.com
- WEB — github.com
- WEB — github.com
- WEB — lists.fedoraproject.org
- WEB — lists.fedoraproject.org
- WEB — lists.fedoraproject.org
- WEB — security.netapp.com
- WEB — security.snyk.io
- WEB — www.dnspython.org
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
15 days ago
dnspython dns.name.from_wire_parser() excessive CPU use
1.0.0 - 1.6.0 and 1.7.1 - 2.0.0rc1 and 2.0.0rc2 and 2.0.0 - 2.1.0rc1 and 2.1.0 - 2.2.0rc1 and 2.2.0 - 2.3.0rc1 and 2.3.0 - 2.4.0rc1 and 2.4.0 - 2.5.0rc1 and 2.5.0 - 2.6.0rc1 and 2.6.0 - 2.7.0rc1 and 2.7.0 - 2.8.0rc1 and 2.8.0 GHSA-45c3-73f7-pv4m
1.0.0 - 1.6.0 and 1.7.1 - 2.0.0rc1 and 2.0.0rc2 and 2.0.0 - 2.1.0rc1 and 2.1.0 - 2.2.0rc1 and 2.2.0 - 2.3.0rc1 and 2.3.0 - 2.4.0rc1 and 2.4.0 - 2.5.0rc1 and 2.5.0 - 2.6.0rc1 and 2.6.0 - 2.7.0rc1 and 2.7.0 - 2.8.0rc1 and 2.8.0 GHSA-45c3-73f7-pv4m
Medium Risk
4 months ago
Potential DoS via the Tudoor mechanism in eventlet and dnspython
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.35.1 PYSEC-2026-2472
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.35.1 PYSEC-2026-2472
Unknown
4 months ago
Eventlet affected by HTTP request smuggling in unparsed trailers
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 PYSEC-2026-1350
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 PYSEC-2026-1350
Medium Risk
4 months ago
Potential DoS via the Tudoor mechanism in eventlet and dnspython
1.0.0 - 1.6.0 and 1.7.1 - 2.0.0rc1 and 2.0.0rc2 and 2.0.0 - 2.1.0rc1 and 2.1.0 - 2.2.0rc1 and 2.2.0 - 2.3.0rc1 and 2.3.0 - 2.4.0rc1 and 2.4.0 - 2.5.0rc1 and 2.5.0 - 2.6.0rc1 and 2.6.0 PYSEC-2026-1307
1.0.0 - 1.6.0 and 1.7.1 - 2.0.0rc1 and 2.0.0rc2 and 2.0.0 - 2.1.0rc1 and 2.1.0 - 2.2.0rc1 and 2.2.0 - 2.3.0rc1 and 2.3.0 - 2.4.0rc1 and 2.4.0 - 2.5.0rc1 and 2.5.0 - 2.6.0rc1 and 2.6.0 PYSEC-2026-1307
Medium Risk
1 year ago
Eventlet affected by HTTP request smuggling in unparsed trailers
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 GHSA-hw6f-rjfj-j7j7
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 GHSA-hw6f-rjfj-j7j7
