p PatchFirst

CVE-2023-29483

CVE-2023-29483

This page contains facts from public vulnerability sources. Check the original advisory before updating.

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

CVSS 7.0 · High · EPSS 1.9% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • dnspython Debian:12

    Versions
    • 2.3.0-1
    • 2.4.0-1
    • 2.4.0~rc1-1
    • 2.4.1-1
    • 2.4.2-1
    • 2.5.0-1
    • 2.5.0~rc1-1
    • 2.6.0-1
    • 2.6.0~rc1-1
    • 2.6.1-1
    • 2.7.0-1
    • 2.7.0~rc1-1
    • 2.8.0-1
    • 2.8.0-2
    • 2.8.0-3
    • 2.8.0-4
    • 2.8.0-5
    • 2.8.0-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnspython Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.6.0-1

    Update to 2.6.0-1

  • dnspython Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.6.0-1

    Update to 2.6.0-1

  • eventlet PyPI

    Versions
    • 0.10.0
    • 0.11.0
    • 0.12.1
    • 0.13.0
    • 0.14.0
    • 0.15.2
    • 0.16.1
    • 0.17.4
    • 0.18.2
    • 0.18.3
    • 0.18.4
    • 0.19.0
    • 0.2
    • 0.20.0
    • 0.20.1
    • 0.21.0
    • 0.22.0
    • 0.22.1
    • 0.23.0
    • 0.24.0
    • 0.24.1
    • 0.25.0
    • 0.25.1
    • 0.25.2
    • 0.26.0
    • 0.26.1
    • 0.27.0
    • 0.28.0
    • 0.28.1
    • 0.29.0
    • 0.29.1
    • 0.30.0
    • 0.30.1
    • 0.30.2
    • 0.30.3
    • 0.31.0
    • 0.31.1
    • 0.32.0
    • 0.33.0
    • 0.33.1
    • 0.33.2
    • 0.33.3
    • 0.34.1
    • 0.34.2
    • 0.34.3
    • 0.35.0
    • 0.35.1
    • 0.5.3
    • 0.6.1
    • 0.7
    • 0.8
    • 0.8.16
    • 0.9.17
    Affected ranges
    • ECOSYSTEM: < 0.35.2

    Update to 0.35.2

  • dnspython PyPI

    Versions
    • 1.0.0
    • 1.1.0
    • 1.10.0
    • 1.11.0
    • 1.11.1
    • 1.12.0
    • 1.13.0
    • 1.14.0
    • 1.15.0
    • 1.16.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.3.5
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.1
    • 1.8.0
    • 1.9.0
    • 1.9.1
    • 1.9.2
    • 1.9.3
    • 1.9.4
    • 2.0.0
    • 2.0.0rc1
    • 2.0.0rc2
    • 2.1.0
    • 2.1.0rc1
    • 2.2.0
    • 2.2.0rc1
    • 2.2.1
    • 2.3.0
    • 2.3.0rc1
    • 2.4.0
    • 2.4.0rc1
    • 2.4.1
    • 2.4.2
    • 2.5.0
    • 2.5.0rc1
    • 2.6.0
    • 2.6.0rc1
    Affected ranges
    • ECOSYSTEM: < 2.6.1

    Update to 2.6.1

  • dnspython Ubuntu:14.04:LTS

    Versions
    • 1.11.0-1
    • 1.11.1-1
    • 1.11.1-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnspython Ubuntu:16.04:LTS

    Versions
    • 1.12.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnspython Ubuntu:18.04:LTS

    Versions
    • 1.15.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnspython Ubuntu:20.04:LTS

    Versions
    • 1.16.0-1
    • 1.16.0-1build1
    • 1.16.0-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnspython Ubuntu:22.04:LTS

    Versions
    • 2.0.0+really1.16.0-2ubuntu2
    • 2.0.0+really1.16.0-2ubuntu3
    • 2.1.0-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →