Heap-Based Buffer Overflow in libidn2: CVE-2019-18224
Summary
ALPINE-CVE-2019-18224: idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string. Affects libidn2 versions < 2.1.1-r0. Fixed in 2.1.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libidn2 is a library that provides support for internationalized domain names (IDN) in applications. It allows software to handle domain names in various languages, making it essential for web applications that require global accessibility. However, a vulnerability in libidn2 has been identified, which can lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2019-18224, exists in the function idn2_to_ascii_4i within the lib/lookup.c file of GNU libidn2 versions prior to 2.1.1. It is a heap-based buffer overflow that can be triggered by supplying a long domain string. This overflow can lead to arbitrary code execution, potentially allowing an attacker to compromise the affected system. The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
How To Fix
Minimum fixed version
2.1.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade libidn2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or overly long domain strings in applications that utilize libidn2 until the package can be updated. This can help mitigate the risk of exploitation.
Conclusion
The CVE-2019-18224 vulnerability in libidn2 poses a significant risk due to its potential for arbitrary code execution. It is crucial for users of this library to update to the patched version as soon as possible and to implement workarounds to mitigate risks until the update can be applied.
See every vulnerability recorded for libidn2 →
FAQ
CVE-2019-18224 is a vulnerability in the libidn2 library that can lead to a heap-based buffer overflow, potentially allowing attackers to execute arbitrary code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to arbitrary code execution, allowing attackers to take control of the affected system.
You can update libidn2 to the patched version 2.1.1-r0 using the command: apk upgrade libidn2.
Yes, avoid processing untrusted or overly long domain strings in applications that use libidn2 as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libidn2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
