`idna` accepts Punycode labels that do not produce any non-ASCII when decoded

🗓️ 09 Dec 2024 12:00:00Reported by rustsecType

Older idna versions may equate punycode and ASCII labels, enabling privilege escalation.

Reporter	Title	Published	Views	Family All 168
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway vulnerable to naming confusion (CVE-2024-12224)	2 Apr 202520:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	26 May 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	4 May 202607:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to idna-0.1.5.crate, idna-0.5.0.crate CVE-2024-12224	8 May 202515:19	–	ibm
AlpineLinux	CVE-2024-12224	30 May 202501:16	–	alpinelinux
Chainguard	CVE-2024-12224 vulnerabilities	9 Dec 202412:00	–	cgr
Circl	CVE-2024-12224	30 May 202502:41	–	circl
CNNVD	Servo 安全漏洞	30 May 202500:00	–	cnnvd
CVE	CVE-2024-12224	30 May 202501:16	–	cve
Cvelist	CVE-2024-12224 idna accepts Punycode labels that do not produce any non-ASCII when decoded	30 May 202501:16	–	cvelist