CVE-2024-3651

2024-04-2300:00:00

ubuntu.com

resource consumption dos

specially crafted inputs

idna.encode

debian

redhat

github

python

pip

binaries

patch

6.3 Medium

AI Score

Confidence

Low

0 Low

EPSS

Percentile

0.0%

JSON

[potential DoS via resource consumption via specially crafted inputs to
idna.encode()]

Bugs

Notes

Author	Note
mdeslaur	On focal and earlier, the python-pip package bundles python-idna binaries when built. After updating python-idna, a no-change rebuild of python-pip is required. On jammy and later, python-idna is bundled in the python-pip package and needs to be patched.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchpython-idna< 2.6-1ubuntu0.1~esm1UNKNOWN
ubuntu20.04noarchpython-idna< 2.8-1ubuntu0.1UNKNOWN
ubuntu22.04noarchpython-idna< 3.3-1ubuntu0.1UNKNOWN
ubuntu23.10noarchpython-idna< 3.3-2ubuntu0.1UNKNOWN
ubuntu24.04noarchpython-idna< 3.6-2ubuntu0.1UNKNOWN
ubuntu16.04noarchpython-idna< 2.0-3ubuntu0.1~esm1UNKNOWN
ubuntu18.04noarchpython-pip< anyUNKNOWN
ubuntu20.04noarchpython-pip< anyUNKNOWN
ubuntu22.04noarchpython-pip< anyUNKNOWN
ubuntu23.10noarchpython-pip< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	python-idna	< 2.6-1ubuntu0.1~esm1	UNKNOWN
ubuntu	20.04	noarch	python-idna	< 2.8-1ubuntu0.1	UNKNOWN
ubuntu	22.04	noarch	python-idna	< 3.3-1ubuntu0.1	UNKNOWN
ubuntu	23.10	noarch	python-idna	< 3.3-2ubuntu0.1	UNKNOWN
ubuntu	24.04	noarch	python-idna	< 3.6-2ubuntu0.1	UNKNOWN
ubuntu	16.04	noarch	python-idna	< 2.0-3ubuntu0.1~esm1	UNKNOWN
ubuntu	18.04	noarch	python-pip	< any	UNKNOWN
ubuntu	20.04	noarch	python-pip	< any	UNKNOWN
ubuntu	22.04	noarch	python-pip	< any	UNKNOWN
ubuntu	23.10	noarch	python-pip	< any	UNKNOWN