Moderate: python-idna security update
Summary
ALSA-2024:4260: Moderate: python-idna security update. Affects python3-idna versions < 2.5-7.el8_10. Fixed in 2.5-7.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3-idna package is a Python library that provides support for Internationalized Domain Names (IDNs). It allows users to encode and decode domain names containing non-ASCII characters. This package is commonly used in web applications and networking tools to handle IDNs. The vulnerability identified in this package can potentially lead to a denial-of-service (DoS) attack by consuming excessive system resources.
Vulnerability Detail
The vulnerability, identified as CVE-2024-3651, exists in the idna.encode() function of the python-idna library. By providing specially crafted inputs to this function, an attacker can cause the application to consume excessive resources, leading to a DoS condition. This vulnerability has been rated as moderate in severity. It is important to note that this vulnerability only affects versions of python-idna up to 2.5-7.el8_10.
How To Fix
Minimum fixed version
2.5-7.el8_10
This is the first release that contains the fix.
sudo dnf update python3-idnaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The python-idna library, specifically the idna.encode() function, is vulnerable to a DoS attack due to excessive resource consumption. To mitigate this vulnerability, it is crucial to update the python3-idna package to version 2.5-7.el8_10 or later. No specific workaround has been provided, and it is recommended to apply the security update promptly.
See every vulnerability recorded for python3-idna →
FAQ
Python-idna is a library that provides support for Internationalized Domain Names (IDNs). It allows encoding and decoding of domain names containing non-ASCII characters.
The vulnerability can lead to a denial-of-service (DoS) attack by causing excessive resource consumption in the application.
Versions up to 2.5-7.el8_10 of python-idna are affected by this vulnerability.
To fix this vulnerability, update the python3-idna package to version 2.5-7.el8_10 or later using the package manager of your operating system.
No specific workaround has been provided for this vulnerability. It is recommended to apply the security update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for python3-idna.
