Impersonation Risk in libidn2: CVE-2019-12290 Vulnerability Overview
Summary
ALPINE-CVE-2019-12290: GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. Affects libidn2 versions < 2.2.0-r0. Fixed in 2.2.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libidn2 is a GNU library that implements the Internationalized Domain Names (IDN) protocol, allowing applications to handle domain names containing non-ASCII characters. It is widely used in various software applications to ensure compatibility with international domain names. However, prior to version 2.2.0, libidn2 had a vulnerability that could allow malicious actors to impersonate legitimate domains by exploiting the conversion process between A-labels and U-labels.
Vulnerability Detail
The vulnerability, identified as CVE-2019-12290, arises from libidn2's failure to perform adequate roundtrip checks as specified in RFC3490 Section 4.2. This oversight allows an attacker to create a malicious domain that closely resembles a target domain, differing only by certain punycoded Unicode characters. When these characters are converted to a Unicode label and then back to an ASCII label, they may be discarded, enabling the attacker to impersonate the legitimate domain. This can lead to phishing attacks and other malicious activities, posing significant risks to users and organizations.
How To Fix
Minimum fixed version
2.2.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade libidn2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional domain validation checks in your application to mitigate the risk of domain impersonation until the library can be updated. This may involve checking for known malicious domains or implementing stricter validation rules for domain names.
Conclusion
The CVE-2019-12290 vulnerability in libidn2 poses a significant risk of domain impersonation, which can lead to serious security breaches. It is crucial for users and developers to update to the patched version of the library and implement additional validation checks to safeguard against potential attacks.
See every vulnerability recorded for libidn2 →
FAQ
CVE-2019-12290 is a vulnerability in the libidn2 library that allows for domain impersonation due to inadequate checks during the conversion of domain names.
Users may be at risk of phishing attacks where malicious domains impersonate legitimate ones, potentially leading to data theft or unauthorized access.
All versions of libidn2 prior to 2.2.0-r0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-12290 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for libidn2.
