Critical Vulnerability in Python-Dnslib Package: ID Value Mismatch in DNS Replies
Summary
UBUNTU-CVE-2022-22846: The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query. Affects python-dnslib versions 0.9.7+hg20170303-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python-Dnslib package is a library used for DNS protocol handling in Python applications. It provides functionalities for creating and parsing DNS messages, making it essential for applications that require DNS resolution. However, versions of this package prior to 0.9.17 are vulnerable to a critical issue where the ID value in a DNS reply does not match the ID value in the corresponding query, potentially leading to DNS spoofing attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2022-22846, arises from the dnslib package failing to verify that the ID value in a DNS reply matches the ID value in the original query. This flaw can allow an attacker to spoof DNS responses, leading to potential data interception or redirection of users to malicious sites. The issue affects multiple versions of the package, with a CVSS score of 7.5 indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement additional validation checks in their DNS handling logic to ensure that the ID values match before processing DNS replies. However, this is not a substitute for updating the package.
Conclusion
The Python-Dnslib package has a critical vulnerability that can lead to serious security risks. It is essential for users to update to the latest patched version to protect their applications from potential DNS spoofing attacks. Utilizing tools like Vulert can further enhance security by providing real-time alerts for vulnerabilities.
See every vulnerability recorded for python-dnslib →
FAQ
CVE-2022-22846 is a vulnerability in the Python-Dnslib package that allows for DNS reply spoofing due to ID value mismatches.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The risks include DNS spoofing attacks, which can lead to data interception, redirection to malicious sites, and loss of user trust.
Yes, the patched version of the Python-Dnslib package is 0.9.17 or higher. Users should update to this version to mitigate the vulnerability.
Vulert uses a manifest file to monitor and alert in real-time for open-source vulnerabilities, allowing developers to stay informed about potential risks without needing to access the code directly.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-dnslib.
