PYSEC-2026-2472
Potential DoS via the Tudoor mechanism in eventlet and dnspython
At a glance
- Published
- Updated
- CVE
- CVE-2023-29483
- Aliases
- GHSA-3rq5-2g8h-59hc, PYSEC-2026-1307
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
Affected packages
| Package | Versions |
|---|---|
| PyPI · eventlet | introduced 0, fixed 0.35.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-29483 ADVISORY
- https://github.com/eventlet/eventlet/issues/913 WEB
- https://github.com/rthalley/dnspython/issues/1045 WEB
- https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4 WEB
- https://github.com/rthalley/dnspython/commit/0ea5ad0a4583e1f519b9bcc67cfac381230d9cf2 WEB
- https://github.com/eventlet/eventlet PACKAGE
- https://github.com/eventlet/eventlet/releases/tag/v0.35.2 WEB
- https://github.com/rthalley/dnspython/releases/tag/v2.6.0 WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRKR57IFVKQC2GCXZBFLCLBAWBWL3F6 WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3BNSIK5NFYSAP53Y45GOCMOQHHDLGIF WEB
- https://security.netapp.com/advisory/ntap-20240510-0001 WEB
- https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713 WEB
- https://www.dnspython.org WEB
- https://pypi.org/project/eventlet PACKAGE
- https://github.com/advisories/GHSA-3rq5-2g8h-59hc ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |