Lucene search

GitHub Advisory DatabaseGHSA-R478-C2PC-M7GX

HistoryJan 12, 2022 - 8:07 p.m.

DNS reply verification issue in dnslinb

2022-01-1220:07:10

GitHub Advisory Database

github.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

31.5%

JSON

The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.

Affected configurations

Vulners

Node

dnslib_projectdnslibRange<0.9.17python

CPENameOperatorVersion
dnsliblt0.9.17

CPE	Name	Operator	Version
	dnslib	lt	0.9.17

References

github.com/advisories/GHSA-r478-c2pc-m7gx

github.com/paulc/dnslib/commit/76e8677699ed098387d502c57980f58da642aeba

github.com/paulc/dnslib/issues/30

nvd.nist.gov/vuln/detail/CVE-2022-22846

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

31.5%

JSON

Related for GHSA-R478-C2PC-M7GX