CVE-2019-12290

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.

References

https://gitlab.com/libidn/libidn2/commit/241e8f486134793cb0f4a5b0e5817a97883401f5

https://gitlab.com/libidn/libidn2/commit/614117ef6e4c60e1950d742e3edf0a0ef8d389de

https://gitlab.com/libidn/libidn2/merge_requests/71

https://usn.ubuntu.com/4168-1/

Details

Source: MITRE

Published: 2019-10-22

Updated: 2019-10-29

Type: CWE-20

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Impact Score: 3.6

Exploitability Score: 3.9

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:gnu:libidn2:*:*:*:*:*:*:*:*

Tenable Plugins

View all (14 total)

IDNameProductFamilySeverity
135125EulerOS Virtualization for ARM 64 3.0.6.0 : libidn2 (EulerOS-SA-2020-1338)NessusHuawei Local Security Checks
high
135018GLSA-202003-63 : GNU IDN Library 2: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
133995EulerOS 2.0 SP8 : libidn2 (EulerOS-SA-2020-1161)NessusHuawei Local Security Checks
high
132322Amazon Linux AMI : libidn2 (ALAS-2019-1327)NessusAmazon Linux Local Security Checks
critical
132261Amazon Linux 2 : libidn2 (ALAS-2019-1373)NessusAmazon Linux Local Security Checks
critical
131684openSUSE Security Update : libidn2 (openSUSE-2019-2613)NessusSuSE Local Security Checks
critical
131682openSUSE Security Update : libidn2 (openSUSE-2019-2611)NessusSuSE Local Security Checks
critical
131548SUSE SLED15 / SLES15 Security Update : libidn2 (SUSE-SU-2019:3086-1)NessusSuSE Local Security Checks
critical
131253Fedora 29 : mingw-libidn2 (2019-28d3cd20c0)NessusFedora Local Security Checks
high
131252Fedora 30 : mingw-libidn2 (2019-20e9736c97)NessusFedora Local Security Checks
high
131250Fedora 31 : mingw-libidn2 (2019-1ebb5c928e)NessusFedora Local Security Checks
high
131149FreeBSD : libidn2 -- roundtrip check vulnerability (f04f840d-0840-11ea-8d66-75d3253ef913)NessusFreeBSD Local Security Checks
high
131147Fedora 31 : libidn2 (2019-f454c7a118)NessusFedora Local Security Checks
high
130393Ubuntu 18.04 LTS / 19.04 : Libidn2 vulnerabilities (USN-4168-1)NessusUbuntu Local Security Checks
critical