GitHub Advisoryadvisory · PyPI

GHSA-3rq5-2g8h-59hc Potential DoS via the Tudoor mechanism in eventlet and dnspython

MEDIUM Published 2024-04-11 Modified 2024-06-26 Official page ↗
Aliases
CVE-2023-29483
Ecosystem
PyPI
Packages
eventlet, dnspython
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-696
Reviewed
2024-04-12

Affected packages

• PyPI eventlet: < 0.35.2 → fixed in 0.35.2 • PyPI dnspython: < 2.6.1 → fixed in 2.6.1

Description

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

Related

Alias · CVE (1)

  • CVE-2023-29483 eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending… vulnerability

Weakness · CWE (1)

  • CWE-696 Incorrect Behavior Order weakness

References