CVE-2023-29483
published 2024-04-11CVE-2023-29483: eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet…
PriorityP341high7CVSS 3.1
AVNACHPRNUINSUCLILAH
EPSS
1.86%
76.8th percentile
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | dnspython | < dnspython 2.6.0-1 (forky) | dnspython 2.6.0-1 (forky) |
| dnspython | dnspython | < 2.6.0 | 2.6.0 |
| dnspython | dnspython | >= 0 < 2.6.0-1 | 2.6.0-1 |
| dnspython | dnspython | >= 0 < 2.6.0-1 | 2.6.0-1 |
| dnspython | dnspython | >= 0 < 2.6.1 | 2.6.1 |
| eventlet | eventlet | < 0.35.2 | 0.35.2 |
| eventlet | eventlet | >= 0 < 0.35.2 | 0.35.2 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dnspython: denial of service in stub resolver
vendor_redhat·2024-02-09·CVSS 7.0
CVE-2023-29483 [HIGH] CWE-696 dnspython: denial of service in stub resolver
dnspython: denial of service in stub resolver
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
The dnspython stub resolver is vulnerable to a denial of service (DoS) risk if an attacker sends a malicious response forged with the correct address and port before a legitimate one arrives on the UDP port used by dnspython for the query. In such case
Debian
CVE-2023-29483: dnspython - eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attacke...
vendor_debian·2023·CVSS 7.0
CVE-2023-29483 [HIGH] CVE-2023-29483: dnspython - eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attacke...
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.6.0-1)
sid: resolved (fixed in 2.6.0-1)
trixie: resolved (fixed in 2.6.0-1)
GHSA
Potential DoS via the Tudoor mechanism in eventlet and dnspython
ghsa·2024-04-11
CVE-2023-29483 [MEDIUM] CWE-696 Potential DoS via the Tudoor mechanism in eventlet and dnspython
Potential DoS via the Tudoor mechanism in eventlet and dnspython
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
OSV
CVE-2023-29483: eventlet before 0
osv·2024-04-11·CVSS 7.0
CVE-2023-29483 [HIGH] CVE-2023-29483: eventlet before 0
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
OSV
Potential DoS via the Tudoor mechanism in eventlet and dnspython
osv·2024-04-11
CVE-2023-29483 [MEDIUM] Potential DoS via the Tudoor mechanism in eventlet and dnspython
Potential DoS via the Tudoor mechanism in eventlet and dnspython
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
No detection rules found.
No public exploits indexed.
https://github.com/eventlet/eventlet/issues/913https://github.com/eventlet/eventlet/releases/tag/v0.35.2https://github.com/rthalley/dnspython/issues/1045https://github.com/rthalley/dnspython/releases/tag/v2.6.0https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRKR57IFVKQC2GCXZBFLCLBAWBWL3F6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3BNSIK5NFYSAP53Y45GOCMOQHHDLGIF/https://security.netapp.com/advisory/ntap-20240510-0001/https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713https://www.dnspython.org/https://github.com/eventlet/eventlet/issues/913https://github.com/eventlet/eventlet/releases/tag/v0.35.2https://github.com/rthalley/dnspython/issues/1045https://github.com/rthalley/dnspython/releases/tag/v2.6.0https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRKR57IFVKQC2GCXZBFLCLBAWBWL3F6/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3BNSIK5NFYSAP53Y45GOCMOQHHDLGIF/https://lists.fedoraproject.org/archives/list/[email protected]/message/NLRKR57IFVKQC2GCXZBFLCLBAWBWL3F6/https://lists.fedoraproject.org/archives/list/[email protected]/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH/https://security.netapp.com/advisory/ntap-20240510-0001/https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713https://www.dnspython.org/
2024-04-11
Published