search

jgeraigery / snyk-cli

Snyk CLI scans and monitors your projects for security vulnerabilities.
https://snyk.io
Other
0 stars 0 forks source link

dnspython-2.3.0-py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.0) #69

Open mend-for-github-com[bot] opened 2 months ago

mend-for-github-com[bot] commented 2 months ago
Vulnerable Library - dnspython-2.3.0-py3-none-any.whl

DNS toolkit

Library home page: https://files.pythonhosted.org/packages/12/86/d305e87555430ff4630d729420d97dece3b16efcbf2b7d7e974d11b0d86c/dnspython-2.3.0-py3-none-any.whl

Path to dependency file: /packages/snyk-fix/test/unit/plugins/python/workspaces/pip-app/requirements.txt

Path to vulnerable library: /packages/snyk-fix/test/unit/plugins/python/workspaces/pip-app/requirements.txt

Found in HEAD commit: 7e83e87477e0886cad26f767efdb9ffd90d9fbfe

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (dnspython version) Remediation Possible** Reachability
CVE-2023-29483 High 7.0 Not Defined 0.0% dnspython-2.3.0-py3-none-any.whl Direct dnspython - 2.6.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-29483 ### Vulnerable Library - dnspython-2.3.0-py3-none-any.whl

DNS toolkit

Library home page: https://files.pythonhosted.org/packages/12/86/d305e87555430ff4630d729420d97dece3b16efcbf2b7d7e974d11b0d86c/dnspython-2.3.0-py3-none-any.whl

Path to dependency file: /packages/snyk-fix/test/unit/plugins/python/workspaces/pip-app/requirements.txt

Path to vulnerable library: /packages/snyk-fix/test/unit/plugins/python/workspaces/pip-app/requirements.txt

Dependency Hierarchy: - :x: **dnspython-2.3.0-py3-none-any.whl** (Vulnerable Library)

Found in HEAD commit: 7e83e87477e0886cad26f767efdb9ffd90d9fbfe

Found in base branch: main

### Vulnerability Details

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

Publish Date: 2024-04-11

URL: CVE-2023-29483

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

### CVSS 3 Score Details (7.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.dnspython.org/news/2.6.0rc1/

Release Date: 2023-04-07

Fix Resolution: dnspython - 2.6.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.