GitHub Advisoryadvisory · PyPI
GHSA-r478-c2pc-m7gx dnslib has DNS reply verification issue
HIGH
Official page ↗
- Aliases
- CVE-2022-22846
- Ecosystem
- PyPI
- Packages
- dnslib
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-345
- Reviewed
- 2022-01-11
Affected packages
• PyPI dnslib: < 0.9.17 → fixed in 0.9.17
Description
The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.
Related
Alias · CVE (1)
- CVE-2022-22846 The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query. vulnerability
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-22846 advisory
- https://github.com/paulc/dnslib/issues/30 web
- https://github.com/paulc/dnslib/commit/76e8677699ed098387d502c57980f58da642aeba web
- https://github.com/advisories/GHSA-r478-c2pc-m7gx advisory
- https://github.com/paulc/dnslib web
- https://github.com/pypa/advisory-database/tree/main/vulns/dnslib/PYSEC-2022-4.yaml web