CVE-2023-29483

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

\

Security Fix(es):

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.(CVE-2023-29483)

\

Security Fix(es):

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.(CVE-2023-29483)

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

The python-dns package contains the dnslib module that implements a DNS client and additional modules that define certain symbolic constants used by DNS, such as dnstype, dnsclass and dnsopcode.

Security Fix(es):

• dnspython: denial of service in stub resolver (CVE-2023-29483)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

The python-dns package contains the dnslib module that implements a DNS client and additional modules that define certain symbolic constants used by DNS, such as dnstype, dnsclass and dnsopcode.

Security Fix(es):

• dnspython: denial of service in stub resolver (CVE-2023-29483)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The python-dns package contains the dnslib module that implements a DNS client and additional modules that define certain symbolic constants used by DNS, such as dnstype, dnsclass and dnsopcode.

Security Fix(es):

• dnspython: denial of service in stub resolver (CVE-2023-29483)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

TuxCare rebuilt dnspython to address 1 CVE. Fixed in 2.3.0.post2+tuxcare.

These are all security issues fixed in the python310-eventlet-0.36.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-dnspython-2.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-pymongo-4.16.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-eventlet-0.41.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-dnspython-2.8.0-2.1 package on the GA media of openSUSE Tumbleweed.

The python-dns package contains the dnslib module that implements a DNS client and additional modules that define certain symbolic constants used by DNS, such as dnstype, dnsclass and dnsopcode.

Security Fix(es):

• dnspython: denial of service in stub resolver (CVE-2023-29483)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for python-aioresponses, python-google-api-core, python-google-api-python-client, python-google-auth, python-google-auth-httplib2, python-google-cloud-appengine-logging, python-google-cloud-artifact-registry, python-google-cloud-audit-log, python-google-cloud-build, python-google-cloud-compute, python-google-cloud-core, python-google-cloud-dns, python-google-cloud-domains, python-google-cloud-iam, python-google-cloud-kms, python-google-cloud-kms-inventory, python-google-cloud-logging, python-google-cloud-run, python-google-cloud-secret-manager, python-google-cloud-service-directory, python-google-cloud-spanner, python-google-cloud-storage, python-google-cloud-vpc-access, python-google-crc32c, python-google-resumable-media, python-googleapis-common-protos, python-grpc-google-iam-v1, python-grpc-interceptor, python-mmh3, python-mypy, python-opentelemetry-resourcedetector-gcp, python-poetry-core, python-proto-plus, python-pytest-asyncio, python-syrupy, python-typed-ast, python-uritemplate, python-dnspython, python-trio, python-websocket-client fixes the following issues:

Changes in python-aioresponses:

• Switch to pyproject macros.

• Update to 0.7.8

  • feat: integer repeat
  • fix: case repeat=1
  • docs: elaborate on meaning in documentation of repeat argument
  • use ClientSession base_url and headers
  • Refactor usage of session base_url and headers
  • Add tests for base_url and headers from session
  • Add repr to RequestMatch
  • Upgrade yarl to be compatible with Python 3.12
  • fix: review suggestion
  • fix: fix test
  • fix: added condition on py3.8 while supporting ClientSession.base_url
  • fix: flake8

• from version 0.7.7

  • added passthrough_unmatched flag for aioresponses class
  • test for passing unmatched requests
  • add a readme description about passthrough_unmatched flag
  • feat: support raise_for_status as callable
  • Add packaging to requirements.txt
  • Update __version__ to latest released version
  • Fix compat with aiohttp 3.11.0+
  • fix: invalid rst code

• Add test_pass_through_unmatched_requests to skipped tests

• Update Requires from requirements.txt

• Add %{?sle15_python_module_pythons}

• update to 0.7.6:

  • refactor: Make mock for writer compatible with 3.9.0b1 and older
  • fix: aiohttp 3.9 _writer can't await

• update to 0.7.5:

  • replaced pkg_resources with packaging module
  • Add Python 3.11 support

• update to 0.7.4:

  • bump py36 to ubuntu 20.04
  • restore 3.6
  • Adjust github actions test workflow
  • Fix python versions in env list
  • Add documentation for repeat argument
  • Add compat module
  • fix long line by adding line breaks
  • shorten comment to obey line length limit
  • split typing and assignment to avoid long line
  • Avoid type confusion by explicitly typing as `ClientResponse`
  • ignore false positive mypy warning when `url_or_pattern` is a `Pattern`
  • add `py.typed` to MANIFEST.in
  • add `py.typed` file to package data in setup.py
  • fix version after release was tagged/released
  • Extend for arguments
  • Init assert_called
  • Fix type annotations

• update to 0.7.3:

  • Support binary bodies in responses
  • fix flake8
  • move RequestInfo to compat
  • drop `.travis.yml`
  • basic CI using github actions
  • (feat) add unit tests
  • (feat) allow for callbacks to be called before raising of exception
  • add `py.typed` (PEP 561)
  • Fix setuptools warnings by replacing dashes in keys with underscores
  • fix version parsing
  • version 0.7.2
  • Update aioresponses/core.py
  • adding catch to ignore ValueError when deepcopy is unsuccessful

• Remove unused patch.

• Update to v0.7.1

  • Fix compatibility with aiohttp 3.7
  • remove asynctest from compat.py
  • Python 3.9 compatibility

• drop patch merged upstream

• fix python version requirement, require asynctest for python36 again

• Remove no longer necessary aioresponses replace asynctest patch

• Add patch to add compatibility with aiohttp…

This update for python-dnspython fixes the following issues:

• CVE-2023-29483: Fixed an issue that allowed remote attackers to interfere with DNS name resolution (bsc#1222693).

This update for python-dnspython fixes the following issues:

• CVE-2023-29483: Fixed an issue that allowed remote attackers to interfere with DNS name resolution (bsc#1222693).

This update for python-dnspython fixes the following issues:

• CVE-2023-29483: Fixed an issue that allowed remote attackers to interfere with DNS name resolution (bsc#1222693).

This update for python-dnspython fixes the following issue:

• Fix CVE-2023-29483 (bsc#1230353).

This update for python-dnspython fixes the following issue:

• Fix CVE-2023-29483 (bsc#1230353).

This update for python-dnspython fixes the following issues:

• CVE-2023-29483: Fixed potential DoS via the Tudoor mechanism (bsc#1222693).