Vulnerability in Dnspython
CVE-2023-29483
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
EPSS: 0.019 (77.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H.
Affected products
- Dnspython
- Eventlet
- Netapp Bootstrap_os
- Netapp Hci_compute_node
- Fedoraproject Fedora — versions 38, 39, 40
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Product)
- cve@mitre.org (Release Notes)
- cve@mitre.org (Exploit, Issue Tracking)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org (Exploit, Issue Tracking)
- cve@mitre.org (Release Notes)
- cve@mitre.org (vendor-advisory, Mailing List)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org (vendor-advisory, Mailing List)
- cve@mitre.org (vendor-advisory, Mailing List)
Frequently asked questions
- What is CVE-2023-29483?
- CVE-2023-29483 is a high-severity vulnerability in Dnspython, classified under CWE-292. CVSS score: 7.0/10. Published 2024-04-11.
- How severe is CVE-2023-29483?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2023-29483 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.