Vulnerability in Dnspython
CVE-2023-29483
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H.
EPSS exploit prediction
EPSS: 0.019 (78.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 78.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.019 · newest: 0.019 · change: 0.000
Affected products
- Dnspython
- Eventlet
- NetApp Bootstrap OS
- NetApp Hci Compute Node
- Fedoraproject Fedora — versions 38, 39, 40
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.dnspython.org/ (Product)
- github.com/rthalley/dnspython/releases/tag/v2.6.0 (Release Notes)
- github.com/rthalley/dnspython/issues/1045 (Exploit, Issue Tracking)
- security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713 (Third Party Advisory)
- github.com/eventlet/eventlet/issues/913 (Exploit, Issue Tracking)
- github.com/eventlet/eventlet/releases/tag/v0.35.2 (Release Notes)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
- security.netapp.com/advisory/ntap-20240510-0001/ (Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
Frequently asked questions
- What is CVE-2023-29483?
- CVE-2023-29483 is a high-severity vulnerability in Dnspython, classified under CWE-292. CVSS score: 7.0/10. Published 2024-04-11.
- How severe is CVE-2023-29483?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2023-29483 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.