p PatchFirst

CVE-2024-3651

CVE-2024-3651 · Denial of Service via Quadratic Complexity in kjd/idna

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

CVSS 6.2 · Medium · EPSS 1.4% · Public exploit · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • kjd/idna

    Versions
    • ≥ unspecified, < 3.7: Affected (custom)

    Update to 3.7

  • python-idna Debian:12

    Versions
    • 3.3-1
    Affected ranges
    • ECOSYSTEM: < 3.3-1+deb12u1

    Update to 3.3-1+deb12u1

  • python-idna Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.6-2.1

    Update to 3.6-2.1

  • python-idna Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.6-2.1

    Update to 3.6-2.1

  • idna PyPI

    Versions
    • 0.1
    • 0.2
    • 0.3
    • 0.4
    • 0.5
    • 0.6
    • 0.7
    • 0.8
    • 0.9
    • 1.0
    • 1.1
    • 2.0
    • 2.1
    • 2.10
    • 2.2
    • 2.3
    • 2.4
    • 2.5
    • 2.6
    • 2.7
    • 2.8
    • 2.9
    • 3.0
    • 3.1
    • 3.2
    • 3.3
    • 3.4
    • 3.5
    • 3.6
    Affected ranges
    • ECOSYSTEM: < 3.7

    Update to 3.7

  • idna PyPI

    Versions
    • 0.1
    • 0.2
    • 0.3
    • 0.4
    • 0.5
    • 0.6
    • 0.7
    • 0.8
    • 0.9
    • 1.0
    • 1.1
    • 2.0
    • 2.1
    • 2.10
    • 2.2
    • 2.3
    • 2.4
    • 2.5
    • 2.6
    • 2.7
    • 2.8
    • 2.9
    • 3.0
    • 3.1
    • 3.2
    • 3.3
    • 3.4
    • 3.5
    • 3.6
    • v3.3
    • v3.2
    • v3.1
    • v3.0
    • v2.10
    • v2.9
    • v2.8
    • v2.7
    • v2.6
    • v2.5
    • v2.4
    • v2.3
    • v2.2
    • v2.1
    • v2.0
    • v1.1
    • v1.0
    • v0.9
    • v0.8
    • v0.7
    • v0.6
    • v0.5
    • v0.4
    • v0.3
    • v0.2
    Affected ranges
    • GIT: < 1d365e17e10d72d0b7876316fc7b9ca0eebdd38d
    • ECOSYSTEM: ≥ 0.1, < 3.7

    Update to 3.7

  • python-idna Ubuntu:Pro:16.04:LTS

    Versions
    • 2.0-3
    Affected ranges
    • ECOSYSTEM: < 2.0-3ubuntu0.1~esm1

    Update to 2.0-3ubuntu0.1~esm1

  • python-pip Ubuntu:Pro:16.04:LTS

    Versions
    • 1.5.6-7ubuntu1
    • 1.5.6-7ubuntu2
    • 8.0.2-7
    • 8.0.3-1
    • 8.0.3-2
    • 8.1.0-1
    • 8.1.0-2
    • 8.1.1-1
    • 8.1.1-2
    • 8.1.1-2ubuntu0.1
    • 8.1.1-2ubuntu0.2
    • 8.1.1-2ubuntu0.4
    • 8.1.1-2ubuntu0.6
    • 8.1.1-2ubuntu0.6+esm2
    • 8.1.1-2ubuntu0.6+esm3
    • 8.1.1-2ubuntu0.6+esm4
    • 8.1.1-2ubuntu0.6+esm5
    • 8.1.1-2ubuntu0.6+esm6
    Affected ranges
    • ECOSYSTEM: < 8.1.1-2ubuntu0.6+esm8

    Update to 8.1.1-2ubuntu0.6+esm8

  • python-idna Ubuntu:Pro:18.04:LTS

    Versions
    • 2.5-1
    • 2.6-1
    Affected ranges
    • ECOSYSTEM: < 2.6-1ubuntu0.1~esm1

    Update to 2.6-1ubuntu0.1~esm1

  • python-pip Ubuntu:Pro:18.04:LTS

    Versions
    • 9.0.1-2
    • 9.0.1-2.3~ubuntu1
    • 9.0.1-2.3~ubuntu1.18.04.1
    • 9.0.1-2.3~ubuntu1.18.04.2
    • 9.0.1-2.3~ubuntu1.18.04.3
    • 9.0.1-2.3~ubuntu1.18.04.4
    • 9.0.1-2.3~ubuntu1.18.04.5
    • 9.0.1-2.3~ubuntu1.18.04.5+esm2
    • 9.0.1-2.3~ubuntu1.18.04.5+esm3
    • 9.0.1-2.3~ubuntu1.18.04.6
    • 9.0.1-2.3~ubuntu1.18.04.6+esm1
    • 9.0.1-2.3~ubuntu1.18.04.7
    • 9.0.1-2.3~ubuntu1.18.04.7+esm1
    • 9.0.1-2.3~ubuntu1.18.04.8
    • 9.0.1-2.3~ubuntu1.18.04.8+esm1
    • 9.0.1-2.3~ubuntu1.18.04.8+esm2
    Affected ranges
    • ECOSYSTEM: < 9.0.1-2.3~ubuntu1.18.04.8+esm4

    Update to 9.0.1-2.3~ubuntu1.18.04.8+esm4

  • python-idna Ubuntu:20.04:LTS

    Versions
    • 2.6-2
    • 2.6-2build1
    • 2.8-1
    Affected ranges
    • ECOSYSTEM: < 2.8-1ubuntu0.1

    Update to 2.8-1ubuntu0.1

  • python-pip Ubuntu:Pro:20.04:LTS

    Versions
    • 18.1-5
    • 18.1-5build1
    • 18.1-5ubuntu1
    • 20.0.2-2
    • 20.0.2-4
    • 20.0.2-5
    • 20.0.2-5ubuntu1
    • 20.0.2-5ubuntu1.1
    • 20.0.2-5ubuntu1.3
    • 20.0.2-5ubuntu1.4
    • 20.0.2-5ubuntu1.5
    • 20.0.2-5ubuntu1.6
    • 20.0.2-5ubuntu1.7
    • 20.0.2-5ubuntu1.8
    • 20.0.2-5ubuntu1.9
    • 20.0.2-5ubuntu1.10
    Affected ranges
    • ECOSYSTEM: < 20.0.2-5ubuntu1.10+esm2

    Update to 20.0.2-5ubuntu1.10+esm2

  • python-idna Ubuntu:22.04:LTS

    Versions
    • 2.10-1
    • 3.2-2
    • 3.3-1
    Affected ranges
    • ECOSYSTEM: < 3.3-1ubuntu0.1

    Update to 3.3-1ubuntu0.1

  • python-pip Ubuntu:22.04:LTS

    Versions
    • 20.3.4-4
    • 21.3.1+dfsg-3
    • 22.0.2+dfsg-1
    • 22.0.2+dfsg-1ubuntu0.1
    • 22.0.2+dfsg-1ubuntu0.2
    • 22.0.2+dfsg-1ubuntu0.3
    • 22.0.2+dfsg-1ubuntu0.4
    • 22.0.2+dfsg-1ubuntu0.5
    • 22.0.2+dfsg-1ubuntu0.6
    Affected ranges
    • ECOSYSTEM: < 22.0.2+dfsg-1ubuntu0.7

    Update to 22.0.2+dfsg-1ubuntu0.7

  • python-idna Ubuntu:24.04:LTS

    Versions
    • 3.3-2
    • 3.6-2
    Affected ranges
    • ECOSYSTEM: < 3.6-2ubuntu0.1

    Update to 3.6-2ubuntu0.1

  • python-pip Ubuntu:24.04:LTS

    Versions
    • 23.2+dfsg-1
    • 23.3+dfsg-1
    • 24.0+dfsg-1
    • 24.0+dfsg-1ubuntu1
    • 24.0+dfsg-1ubuntu1.1
    • 24.0+dfsg-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 24.0+dfsg-1ubuntu1.3

    Update to 24.0+dfsg-1ubuntu1.3

Original sources

Check your server →