PT-2019-4767 · Gnu+4 · Libidn2+4
Publicado
2019-05-23
·
Atualizado
2019-12-31
·
CVE-2019-12290
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
GNU libidn2 versions prior to 2.2.0
Description
The issue exists due to insufficient input validation in the RFC3490 component of the Libidn2 library. This can be exploited by a remote attacker to create a malicious domain that impersonates a target domain. By creating a domain that matches the target except for certain Unicode characters encoded in punycode, an attacker can impersonate arbitrary domains.
Recommendations
For GNU libidn2 versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of punycode conversions to minimize the risk of domain impersonation.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Suse
Ubuntu
Libidn2