Detections
Analytics

Dnspython < 2.6.0rc1 DoS

medium Nessus Plugin ID 192941

Language:

Synopsis

A Python library installed on the remote host is affected by a denial of service vulnerability.

Description

The version of dnspython installed on the remote host is prior to 2.6.0rc1. It is, therefore, affected by a denial of service (DoS) vulnerability. The dnspython stub resolver is vulnerable to a potential DoS if a bad-in-some-way response from the right address and port forged by an attacker arrives before a legitimate one on the UDP port dnspython is using for that query. In this situation, dnspython might switch to querying another resolver or give up entirely, possibly denying service for that resolution.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Also note that this plugin does not distinguish between Python packages installed via the OS package manager, Python packages installed via PIP, or other sources. As a result, packages provided by your OS package repository may have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for CVE-2023-29483 to check for backported fixes.

Solution

Upgrade to dnspython version 2.6.0rc1 or later.

See Also

https://www.dnspython.org/news/2.6.0rc1/

Plugin Details

Severity: Medium

ID: 192941

File Name: dnspython_CVE-2023-29483.nasl

Version: 1.2

Type: local

Family: Misc.

Published: 4/5/2024

Updated: 4/16/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2023-29483

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:python:dnspython

Required KB Items: Host/nix/Python/Packages/Enumerated

Exploit Ease: No known exploits are available

Patch Publication Date: 2/10/2024

Vulnerability Publication Date: 2/10/2024

Reference Information

CVE: CVE-2023-29483

IAVB: 2024-B-0029