CVE-2023-29483

Published: Apr 11, 2024Modified: Jun 17, 2026

7.0

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Exploitability: 2.2 / Impact: 4.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

Affected (6)

Products: Eventlet: Eventlet · Dnspython: Dnspython · Fedoraproject: Fedora · +1 more

Show all products

Eventlet: Eventlet · Dnspython: Dnspython · Fedoraproject: Fedora · Netapp: Bootstrap Os

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eventlet Eventlet	Before 0.35.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Dnspython Dnspython	Before 2.6.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 38
Fedoraproject Fedora	Version 39
Fedoraproject Fedora	Version 40

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Bootstrap Os	All versions

Running on/with	Platform Versions
Netapp Hci Compute Node	All versions

Related CWEs

DEPRECATED: Trusting Self-reported DNS Name

This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.

References (22)

https://github.com/eventlet/eventlet/issues/913

Source: cve@mitre.org

ExploitIssue Tracking

https://github.com/eventlet/eventlet/releases/tag/v0.35.2

Source: cve@mitre.org

Release Notes

https://github.com/rthalley/dnspython/issues/1045

Source: cve@mitre.org

ExploitIssue Tracking

https://github.com/rthalley/dnspython/releases/tag/v2.6.0

Source: cve@mitre.org

Release Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRKR57IFVKQC2GCXZBFLCLBAWBWL3F6/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3BNSIK5NFYSAP53Y45GOCMOQHHDLGIF/

Source: cve@mitre.org

Mailing List

https://security.netapp.com/advisory/ntap-20240510-0001/

Source: cve@mitre.org

Third Party Advisory

https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713

Source: cve@mitre.org

Third Party Advisory

https://www.dnspython.org/

Source: cve@mitre.org

Product

https://github.com/eventlet/eventlet/issues/913

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue Tracking

https://github.com/eventlet/eventlet/releases/tag/v0.35.2

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://github.com/rthalley/dnspython/issues/1045

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue Tracking

https://github.com/rthalley/dnspython/releases/tag/v2.6.0

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRKR57IFVKQC2GCXZBFLCLBAWBWL3F6/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3BNSIK5NFYSAP53Y45GOCMOQHHDLGIF/

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NLRKR57IFVKQC2GCXZBFLCLBAWBWL3F6/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20240510-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.dnspython.org/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.