RUSTSEC-2024-0421 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded

🗓️ 09 Dec 2024 12:00:00Reported by GoogleType

osv🔗 osv.dev👁 21 Views

`idna` 0.5.0 enables privilege escalation due to non-ASCII Punycode issues; upgrade advised.

Reporter	Title	Published	Views	Family All 165
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway vulnerable to naming confusion (CVE-2024-12224)	2 Apr 202520:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	26 May 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	4 May 202607:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to idna-0.1.5.crate, idna-0.5.0.crate CVE-2024-12224	8 May 202515:19	–	ibm
AlpineLinux	CVE-2024-12224	30 May 202501:16	–	alpinelinux
BDU FSTEC	The vulnerability of the Punycode character transformation method, which is used to process domain names, allows attackers to increase their privileges.	28 Oct 202500:00	–	bdu_fstec
Chainguard	CVE-2024-12224 vulnerabilities	9 Dec 202412:00	–	cgr
Circl	CVE-2024-12224	30 May 202502:41	–	circl
CNNVD	Servo 安全漏洞	30 May 202500:00	–	cnnvd
CVE	CVE-2024-12224	30 May 202501:16	–	cve