CVE-2023-29483

2024-04-1100:00:00

ubuntu.com

dnspython

vulnerability

dos

udp port

forged responses

6.2 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.1%

JSON

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote
attackers to interfere with DNS name resolution by quickly sending an
invalid packet from the expected IP address and source port, aka a “TuDoor”
attack. In other words, dnspython does not have the preferred behavior in
which the DNS name resolution algorithm would proceed, within the full time
window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is
unusable for a different reason that was addressed in 2.6.1.

Notes

Author	Note
	Priority reason: Not considered an important issue by upstream dnspython developers
mdeslaur	upstream doesn’t consider this important enough to backport to earlier releases: https://github.com/rthalley/dnspython/issues/1051#issuecomment-1949383928

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchdnspython< anyUNKNOWN
ubuntu20.04noarchdnspython< anyUNKNOWN
ubuntu22.04noarchdnspython< anyUNKNOWN
ubuntu23.10noarchdnspython< anyUNKNOWN
ubuntu24.04noarchdnspython< anyUNKNOWN
ubuntu14.04noarchdnspython< anyUNKNOWN
ubuntu16.04noarchdnspython< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	dnspython	< any	UNKNOWN
ubuntu	20.04	noarch	dnspython	< any	UNKNOWN
ubuntu	22.04	noarch	dnspython	< any	UNKNOWN
ubuntu	23.10	noarch	dnspython	< any	UNKNOWN
ubuntu	24.04	noarch	dnspython	< any	UNKNOWN
ubuntu	14.04	noarch	dnspython	< any	UNKNOWN
ubuntu	16.04	noarch	dnspython	< any	UNKNOWN