Star1
8
Code
Code
Issues1
Pull Requests7
Discussion
Wiki
Analysis
Star1
8
Open
CVE-2023-29483 #9
openeuler-ci-botAdd on  Apr 9, 2024
openeuler-ci-bot
openeuler-ci-botCollaborators
Apr 9, 2024 Create

一、漏洞信息
漏洞编号：CVE-2023-29483
漏洞归属组件：python-dns
漏洞归属的版本：1.15.0,1.16.0,2.1.0,2.2.0,2.2.1,2.3.0,2.4.2,2.6.1
CVSS评分：
BaseScore：N/A None
Vector：
漏洞简述：
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a TuDoor attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
漏洞公开时间：2024-04-11 22:15:12
漏洞创建时间：2024-04-09 10:15:29
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-29483

更多参考(点击展开)
参考来源 参考链接 来源链接
cve.mitre.org https://github.com/eventlet/eventlet/issues/913
cve.mitre.org https://github.com/eventlet/eventlet/releases/tag/v0.35.2
cve.mitre.org https://github.com/rthalley/dnspython/issues/1045
cve.mitre.org https://github.com/rthalley/dnspython/releases/tag/v2.6.0
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRKR57IFVKQC2GCXZBFLCLBAWBWL3F6/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH/
cve.mitre.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3BNSIK5NFYSAP53Y45GOCMOQHHDLGIF/
cve.mitre.org https://security.netapp.com/advisory/ntap-20240510-0001/
cve.mitre.org https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713
cve.mitre.org https://www.dnspython.org/
suse_bugzilla http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-29483 https://bugzilla.suse.com/show_bug.cgi?id=1222693
suse_bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2274520 https://bugzilla.suse.com/show_bug.cgi?id=1222693
suse_bugzilla https://www.cve.org/CVERecord?id=CVE-2023-29483 https://bugzilla.suse.com/show_bug.cgi?id=1222693
suse_bugzilla https://github.com/eventlet/eventlet/issues/913 https://bugzilla.suse.com/show_bug.cgi?id=1222693
suse_bugzilla https://github.com/eventlet/eventlet/releases/tag/v0.35.2 https://bugzilla.suse.com/show_bug.cgi?id=1222693
suse_bugzilla https://github.com/rthalley/dnspython/issues/1045 https://bugzilla.suse.com/show_bug.cgi?id=1222693
suse_bugzilla https://github.com/rthalley/dnspython/releases/tag/v2.6.0 https://bugzilla.suse.com/show_bug.cgi?id=1222693
suse_bugzilla https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713 https://bugzilla.suse.com/show_bug.cgi?id=1222693
suse_bugzilla https://www.dnspython.org/ https://bugzilla.suse.com/show_bug.cgi?id=1222693
redhat_bugzilla https://www.dnspython.org/news/2.6.0rc1/ https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://github.com/rthalley/dnspython/commit/f66e25b5f549acf66d1fb6ead13eb3cff7d09af3 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://github.com/rthalley/dnspython/commit/e093299a49967696b1c58b68e4767de5031a3e46 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://github.com/rthalley/dnspython/issues/1051#issuecomment-1949383928 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://github.com/eventlet/eventlet/issues/913 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://github.com/eventlet/eventlet/releases/tag/v0.35.2 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://access.redhat.com/errata/RHSA-2024:3275 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://access.redhat.com/errata/RHSA-2024:3483 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://access.redhat.com/errata/RHSA-2024:0045 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://access.redhat.com/errata/RHSA-2024:4699 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://access.redhat.com/errata/RHSA-2024:4846 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://access.redhat.com/errata/RHSA-2024:4960 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
redhat_bugzilla https://access.redhat.com/errata/RHSA-2024:9423 https://bugzilla.redhat.com/show_bug.cgi?id=2274520
ubuntu https://www.dnspython.org/news/2.6.0rc1/ https://ubuntu.com/security/CVE-2023-29483
ubuntu https://www.cve.org/CVERecord?id=CVE-2023-29483 https://ubuntu.com/security/CVE-2023-29483
ubuntu https://nvd.nist.gov/vuln/detail/CVE-2023-29483 https://ubuntu.com/security/CVE-2023-29483
ubuntu https://launchpad.net/bugs/cve/CVE-2023-29483 https://ubuntu.com/security/CVE-2023-29483
ubuntu https://security-tracker.debian.org/tracker/CVE-2023-29483 https://ubuntu.com/security/CVE-2023-29483
debian https://security-tracker.debian.org/tracker/CVE-2023-29483
anolis https://anas.openanolis.cn/cves/detail/CVE-2023-29483
cve_search https://www.dnspython.org/
cve_search https://github.com/rthalley/dnspython/releases/tag/v2.6.0
cve_search https://github.com/rthalley/dnspython/issues/1045
cve_search https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713
cve_search https://github.com/eventlet/eventlet/issues/913
cve_search https://github.com/eventlet/eventlet/releases/tag/v0.35.2
cve_search https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH/
cve_search https://security.netapp.com/advisory/ntap-20240510-0001/
cve_search https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRKR57IFVKQC2GCXZBFLCLBAWBWL3F6/
cve_search https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3BNSIK5NFYSAP53Y45GOCMOQHHDLGIF/
github_advisory https://github.com/eventlet/eventlet/issues/913 https://github.com/advisories/GHSA-3rq5-2g8h-59hc
github_advisory https://github.com/rthalley/dnspython/issues/1045 https://github.com/advisories/GHSA-3rq5-2g8h-59hc
github_advisory https://github.com/rthalley/dnspython/releases/tag/v2.6.0 https://github.com/advisories/GHSA-3rq5-2g8h-59hc
github_advisory https://github.com/rthalley/dnspython/commit/0ea5ad0a4583e1f519b9bcc67cfac381230d9cf2 https://github.com/advisories/GHSA-3rq5-2g8h-59hc
github_advisory https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4 https://github.com/advisories/GHSA-3rq5-2g8h-59hc
github_advisory https://nvd.nist.gov/vuln/detail/CVE-2023-29483 https://github.com/advisories/GHSA-3rq5-2g8h-59hc
github_advisory https://github.com/eventlet/eventlet/releases/tag/v0.35.2 https://github.com/advisories/GHSA-3rq5-2g8h-59hc
github_advisory https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713 https://github.com/advisories/GHSA-3rq5-2g8h-59hc
snyk https://github.com/rthalley/dnspython/commit/f66e25b5f549acf66d1fb6ead13eb3cff7d09af3 https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713
snyk https://github.com/rthalley/dnspython/issues/1045 https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713
snyk https://lixiang521.com/publication/oakland24/sp24spring-tudoor-li.pdf https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713

漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

详情(点击展开)
影响的包 修复版本 修复补丁 问题引入补丁 来源
https://github.com/rthalley/dnspython/commit/f66e25b5f549acf66d1fb6ead13eb3cff7d09af3 redhat_bugzilla
https://github.com/rthalley/dnspython/commit/e093299a49967696b1c58b68e4767de5031a3e46 redhat_bugzilla
https://github.com/rthalley/dnspython/commit/0ea5ad0a4583e1f519b9bcc67cfac381230d9cf2 github_advisory
https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4 github_advisory
https://github.com/rthalley/dnspython/commit/f66e25b5f549acf66d1fb6ead13eb3cff7d09af3 snyk
dnspython https://github.com/rthalley/dnspython/commit/f66e25b5f549acf66d1fb6ead13eb3cff7d09af3 ubuntu
dnspython https://github.com/rthalley/dnspython/commit/e093299a49967696b1c58b68e4767de5031a3e46 ubuntu

二、漏洞分析结构反馈
影响性分析说明：
远程攻击者通过从预期的IP地址和源端口快速发送无效数据包来干扰DNS名称解析，也称为“TuDoor”攻击，即dnspython不具有DNS名称解析算法在完整时间窗口内继续执行以等待有效数据包的首选行为。
openEuler评分：
5.9
Vector：CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(2.8.0):受影响
2.openEuler-20.03-LTS-SP4(1.16.0):受影响
3.openEuler-22.03-LTS-SP1(2.2.1):受影响
4.openEuler-22.03-LTS-SP3(2.2.1):受影响
5.openEuler-22.03-LTS-SP4(2.2.1):受影响
6.openEuler-24.03-LTS(2.4.2):受影响
7.openEuler-24.03-LTS-Next(2.4.2):受影响
8.openEuler-24.03-LTS-SP2(2.4.2):不受影响
9.openEuler-24.03-LTS-SP1(2.4.2):不受影响
10.openEuler-24.03-LTS-SP3(2.4.2):不受影响
11.openEuler-24.03-LTS-SP4(2.4.2):不受影响

修复是否涉及abi变化(是/否)：
1.master(2.8.0):是
2.openEuler-20.03-LTS-SP4(1.16.0):是
3.openEuler-22.03-LTS-SP1(2.2.1):是
4.openEuler-22.03-LTS-SP3(2.2.1):是
5.openEuler-22.03-LTS-SP4(2.2.1):是
6.openEuler-24.03-LTS-Next(2.4.2):是
7.openEuler-24.03-LTS-SP1(2.4.2):否
8.openEuler-24.03-LTS-SP2(2.4.2):否
9.openEuler-24.03-LTS(2.4.2):是
10.openEuler-24.03-LTS-SP3(2.4.2):否
11.openEuler-24.03-LTS-SP4(2.4.2):否

原因说明：
1.openEuler-24.03-LTS-SP1(2.4.2):不受影响-漏洞代码不存在
2.openEuler-24.03-LTS-SP2(2.4.2):不受影响-漏洞代码不存在
3.openEuler-24.03-LTS-SP3(2.4.2):不受影响-漏洞代码不存在
4.openEuler-24.03-LTS-SP4(2.4.2):不受影响-漏洞代码不存在
5.master(2.8.0):正常修复
6.openEuler-22.03-LTS-SP4(2.2.1):正常修复
7.openEuler-24.03-LTS-Next(2.4.2):正常修复
8.openEuler-20.03-LTS-SP4(1.16.0):暂不修复-暂无解决方案或补丁

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Apr 9, 2024 Comments：

@licihua ,@algorithmofdish ,@Charlie_li ,@zengwefeng ,@Lostwayzxc
issue处理注意事项:
1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;
2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;
3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否))不能省略,省略后cve-manager将无法正常解析填写内容.

影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响):
1.master(2.3.0):
2.openEuler-20.03-LTS-SP1(1.16.0):
3.openEuler-20.03-LTS-SP4(1.16.0):
4.openEuler-22.03-LTS(2.1.0):
5.openEuler-22.03-LTS-Next(2.2.1):
6.openEuler-22.03-LTS-SP1(2.2.1):
7.openEuler-22.03-LTS-SP2(2.2.1):
8.openEuler-22.03-LTS-SP3(2.2.1):
9.openEuler-24.03-LTS:
10.openEuler-24.03-LTS-Next:

修复是否涉及abi变化(是/否)：
1.master(2.3.0):
2.openEuler-20.03-LTS-SP1(1.16.0):
3.openEuler-20.03-LTS-SP4(1.16.0):
4.openEuler-22.03-LTS(2.1.0):
5.openEuler-22.03-LTS-Next(2.2.1):
6.openEuler-22.03-LTS-SP1(2.2.1):
7.openEuler-22.03-LTS-SP2(2.2.1):
8.openEuler-22.03-LTS-SP3(2.2.1):
9.openEuler-24.03-LTS:
10.openEuler-24.03-LTS-Next:

issue处理具体操作请参考:
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Apr 9, 2024 Comments：

Hi openeuler-ci-bot, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Programming-language, and any of the maintainers: @licihua , @algorithmofdish , @Charlie_li , @zengwefeng , @Lostwayzxc

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Apr 9, 2024 Comments：
参考网址 关联pr 状态 补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2023-29483
https://www.opencve.io/cve/CVE-2023-29483
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-29483
https://security-tracker.debian.org/tracker/CVE-2023-29483NoneNonehttps://github.com/rthalley/dnspython/commit/f66e25b5f549acf66d1fb6ead13eb3cff7d09af3
https://github.com/rthalley/dnspython/commit/e093299a49967696b1c58b68e4767de5031a3e46

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址 补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

likedislike
Zzhangxingrong
Apr 17, 2024 关联了src-openEuler/python-dns Pull Request !43
AAtomGit-Bot
Apr 18, 2024 关联了src-openEuler/python-dns Pull Request !45
123 messages are collapsed here。 See more
openeuler-ci-botopeneuler-ci-botCollaborators
Jun 17 Modify description of issue
openeuler-ci-bot
openeuler-ci-botCollaborators
Jun 17 Comments：

经过cve-manager解析，部分字段填写错误，如红色字体所示：

影响性分析说明:

远程攻击者通过从预期的IP地址和源端口快速发送无效数据包来干扰DNS名称解析，也称为“TuDoor”攻击，即dnspython不具有DNS名称解析算法在完整时间窗口内继续执行以等待有效数据包...

openEuler评分: (评分和向量)
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响):
1.master:受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP1:受影响
4.openEuler-22.03-LTS-SP3:受影响
5.openEuler-22.03-LTS-SP4:受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:受影响
8.openEuler-24.03-LTS-SP1:不受影响
9.openEuler-24.03-LTS-SP2:不受影响
10.openEuler-24.03-LTS-SP3:不受影响
11.openEuler-24.03-LTS-SP4:不受影响

修复是否涉及abi变化(是/否)：
1.master:是
2.openEuler-20.03-LTS-SP4:是
3.openEuler-22.03-LTS-SP1:是
4.openEuler-22.03-LTS-SP3:是
5.openEuler-22.03-LTS-SP4:是
6.openEuler-24.03-LTS:是
7.openEuler-24.03-LTS-Next:是
8.openEuler-24.03-LTS-SP1:否
9.openEuler-24.03-LTS-SP2:否
10.openEuler-24.03-LTS-SP3:否
11.openEuler-24.03-LTS-SP4:否

原因说明：
1.master:正常修复
2.openEuler-20.03-LTS-SP4:(请填写此字段)
3.openEuler-22.03-LTS-SP4:正常修复
4.openEuler-24.03-LTS-Next:正常修复
5.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不存在
6.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP3:不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP4:不受影响-漏洞代码不存在

likedislike
S
SPYFAMILYCollaborators
Jun 17 Comments：

原因说明：
1.master:正常修复
2.openEuler-20.03-LTS-SP4:暂不修复-暂无解决方案或补丁

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jun 17 Modify description of issue
openeuler-ci-bot
openeuler-ci-botCollaborators
Jun 17 Comments：

@ 经过 cve-manager 解析, 已分析的内容如下表所示:

状态 分析项目 内容
已分析 1.影响性分析说明 远程攻击者通过从预期的IP地址和源端口快速发送无效数据包来干扰DNS名称解析，也称为“TuDoor”攻击，即dnspython不具有DNS名称解析算法在完整时间窗口内继续执行以等待有效数据包的首选行为。
已分析 2.openEulerScore 5.9
已分析 3.openEulerVector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
已分析 4.受影响版本排查 master:受影响,openEuler-20.03-LTS-SP4:受影响,openEuler-22.03-LTS-SP1:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS:受影响,openEuler-24.03-LTS-Next:受影响,openEuler-24.03-LTS-SP2:不受影响,openEuler-24.03-LTS-SP1:不受影响,openEuler-24.03-LTS-SP3:不受影响,openEuler-24.03-LTS-SP4:不受影响
已分析 5.是否涉及abi变化 master:是,openEuler-20.03-LTS-SP4:是,openEuler-22.03-LTS-SP1:是,openEuler-22.03-LTS-SP3:是,openEuler-22.03-LTS-SP4:是,openEuler-24.03-LTS-Next:是,openEuler-24.03-LTS-SP1:否,openEuler-24.03-LTS-SP2:否,openEuler-24.03-LTS:是,openEuler-24.03-LTS-SP3:否,openEuler-24.03-LTS-SP4:否
已分析 6.原因说明 openEuler-24.03-LTS-SP1:不受影响-漏洞代码不存在,openEuler-24.03-LTS-SP2:不受影响-漏洞代码不存在,openEuler-24.03-LTS-SP3:不受影响-漏洞代码不存在,openEuler-24.03-LTS-SP4:不受影响-漏洞代码不存在,master:正常修复,openEuler-22.03-LTS-SP4:正常修复,openEuler-24.03-LTS-Next:正常修复,openEuler-20.03-LTS-SP4:暂不修复-暂无解决方案或补丁

请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.

likedislike