CVE-2023-29483

eventlet, dnspython, fedoraproject fedora +1 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-29483

Katalog CVE

CVSS 7.0 · High EPSS 1,9%

Kerentanan DEPRECATED: Trusting Self-reported DNS Name pada eventlet, dnspython +2 lainnya. Skor CVSS 3.1 7.0 (High) menurut CISA ADP.

Deskripsi (NVD)

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

Rincian

Terbit di NVD
11 April 2024
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.0 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-292: DEPRECATED: Trusting Self-reported DNS Name
EPSS (30 hari)
1,9% peluang dieksploitasi; lebih tinggi dari 78,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
eventlet eventlet Semua versi sebelum 0.35.2
dnspython dnspython Semua versi sebelum 2.6.0
fedoraproject fedora Versi 38
fedoraproject fedora Versi 39
fedoraproject fedora Versi 40
netapp bootstrap os Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.