CVE-2024-3651

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode() function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the idna.encode() function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode() function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the idna.encode() function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode() function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the idna.encode() function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode() function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the idna.encode() function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode() function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the idna.encode() function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode() function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the idna.encode() function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

Impact

A specially crafted argument to the idna.encode() function could consume significant resources. This may lead to a denial-of-service.

Patches

The function has been refined to reject such strings without the associated resource consumption in version 3.7.

Workarounds

Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the idna.encode() function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.

References

• https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb

A library to support the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891 http://tools.ietf.org/html/rfc5891. This version of the protocol is often referred to as “IDNA2008” and can produce different results from the earlier standard from 2003.

Security Fix(es):

A flaw was found in the python-idna library. A malicious argument was sent to the idna.encode() function can trigger an uncontrolled resource consumption, resulting in a denial of service.(CVE-2024-3651)

A library to support the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891 http://tools.ietf.org/html/rfc5891. This version of the protocol is often referred to as “IDNA2008” and can produce different results from the earlier standard from 2003.

Security Fix(es):

A flaw was found in the python-idna library. A malicious argument was sent to the idna.encode() function can trigger an uncontrolled resource consumption, resulting in a denial of service.(CVE-2024-3651)

A library to support the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891 http://tools.ietf.org/html/rfc5891. This version of the protocol is often referred to as “IDNA2008” and can produce different results from the earlier standard from 2003.

Security Fix(es):

A flaw was found in the python-idna library. A malicious argument was sent to the idna.encode() function can trigger an uncontrolled resource consumption, resulting in a denial of service.(CVE-2024-3651)

A library to support the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891 http://tools.ietf.org/html/rfc5891. This version of the protocol is often referred to as “IDNA2008” and can produce different results from the earlier standard from 2003.

Security Fix(es):

A flaw was found in the python-idna library. A malicious argument was sent to the idna.encode() function can trigger an uncontrolled resource consumption, resulting in a denial of service.(CVE-2024-3651)

pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2>/dev/null); echo ${b:-/bash_completion.d}) Name: python-pip Version: 23.3.1 Release: 1 Summary: A tool for installing and managing Python packages License: MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) URL: http://www.pip-installer.org Source0: Source1: pip.loongarch.conf BuildArch: noarch Patch1: remove-existing-dist-only-if-path-conflicts. Patch6000: dummy-certifi.patch

Security Fix(es):

A flaw was found in the python-idna library. A malicious argument was sent to the idna.encode() function can trigger an uncontrolled resource consumption, resulting in a denial of service.(CVE-2024-3651)

pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2>/dev/null); echo ${b:-/bash_completion.d}) Name: python-pip Version: 23.3.1 Release: 1 Summary: A tool for installing and managing Python packages License: MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) URL: http://www.pip-installer.org Source0: Source1: pip.loongarch.conf BuildArch: noarch Patch1: remove-existing-dist-only-if-path-conflicts. Patch6000: dummy-certifi.patch

Security Fix(es):

A flaw was found in the python-idna library. A malicious argument was sent to the idna.encode() function can trigger an uncontrolled resource consumption, resulting in a denial of service.(CVE-2024-3651)

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode() function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the idna.encode() function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

The hsakmt packages include a thunk library for AMD's Heterogeneous System Architecture (HSA) Linux kernel driver (amdkfd).

Security Fix(es):

• python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() (CVE-2024-3651)

The hsakmt packages include a thunk library for AMD's Heterogeneous System Architecture (HSA) Linux kernel driver (amdkfd).

Security Fix(es):

• python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() (CVE-2024-3651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2024-3651 in the rootio-idna package for Root:PyPI. Multiple fixed versions available.

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode() function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the idna.encode() function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python39:3.9/python39: python: Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597)
• python39:3.9/python39: python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450)
• python39:3.9/python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() (CVE-2024-3651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The hsakmt packages include a thunk library for AMD's Heterogeneous System Architecture (HSA) Linux kernel driver (amdkfd).

Security Fix(es):

• python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() (CVE-2024-3651)

The hsakmt packages include a thunk library for AMD's Heterogeneous System Architecture (HSA) Linux kernel driver (amdkfd).

Security Fix(es):

• python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() (CVE-2024-3651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

TuxCare rebuilt idna to address 1 CVE. Fixed in 2.1.post1+tuxcare.

TuxCare rebuilt idna to address 1 CVE. Fixed in 2.8.post1+tuxcare.

TuxCare rebuilt idna to address 1 CVE. Fixed in 3.6.post1+tuxcare.

• CVE-2024-3651: more efficient resolution of joiner contexts in idna library to avoid quadratic complexity that leads to a DoS condition

TuxCare rebuilt idna to address 1 CVE. Fixed in 2.10.post1+tuxcare.

• CVE-2024-3651: quadratic-time DoS in valid_contextj()

mingw-python-idna: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()

These are all security issues fixed in the python310-idna-3.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-idna-3.19-1.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Fixed failing x509 tests with OpenSSL < 1.1
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Allow NamedLoaderContexts to be returned from loader
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Prevent using SyncWrapper with no reason
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Increase warn_until_date date for code we still support
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Improved error handling with different OpenSSL versions
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Use Pygit2 id instead of deprecated oid in gitfs
  • Added passlib Python module to the bundle

This update for python-idna fixes the following issues:

• CVE-2024-3651: Fixed potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842).

This update for python-idna fixes the following issues:

• CVE-2024-3651: Fixed potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842).

This update for python-idna fixes the following issues:

• CVE-2024-3651: Fixed potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842).

This update for python-idna fixes the following issues:

• CVE-2024-3651: Fixed a denial of service via resource consumption through specially crafted inputs to idna.encode() (bsc#1222842)

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Added passlib Python module to the bundle
  • Allow NamedLoaderContexts to be returned from loader
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Fixed failing x509 tests with OpenSSL < 1.1
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Fixed zyppnotify plugin after latest zypp/libzypp upgrades (bsc#1231697, bsc#1231045)
  • Improved error handling with different OpenSSL versions
  • Increase warn_until_date date for code we still support
  • Prevent using SyncWrapper with no reason
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Use Pygit2 id instead of deprecated oid in gitfs

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Added passlib Python module to the bundle
  • Allow NamedLoaderContexts to be returned from loader
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Fixed failing x509 tests with OpenSSL < 1.1
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Fixed too frequent systemd service restart in test_system test
  • Fixed zyppnotify plugin after latest zypp/libzypp upgrades (bsc#1231697, bsc#1231045)
  • Improved error handling with different OpenSSL versions
  • Increase warn_until_date date for code we still support
  • Prevent using SyncWrapper with no reason
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Use Pygit2 id instead of deprecated oid in gitfs

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Fixed failing x509 tests with OpenSSL < 1.1
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Allow NamedLoaderContexts to be returned from loader
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Prevent using SyncWrapper with no reason
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Increase warn_until_date date for code we still support
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Improved error handling with different OpenSSL versions
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Use Pygit2 id instead of deprecated oid in gitfs
  • Added passlib Python module to the bundle

Guido Vranken discovered that idna did not properly manage certain inputs, which could lead to significant resource consumption. An attacker could possibly use this issue to cause a denial of service.