PT-2022-15706 · Pypi · Dnslib

Daniel4X · Published 2022-01-09 · Updated 2022-01-18 · CVE-2022-22846

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions dnslib versions 0.9.16 and earlier

Description The issue concerns the dnslib package for Python, which fails to verify that the ID value in a DNS reply matches an ID value in a query. This lack of verification can lead to potential security issues.

Recommendations For versions 0.9.16 and earlier, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2022-22846

GHSA-R478-C2PC-M7GX

PYSEC-2022-4

Affected Products

Dnslib

References · 15

• https://github.com/paulc/dnslib/issues/30 · Patch
• https://osv.dev/vulnerability/PYSEC-2022-4 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-22846 · Security Note
• https://ubuntu.com/security/CVE-2022-22846 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-22846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22846 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22846 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r478-c2pc-m7gx · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-22846 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-22846 · Vendor Advisory
• https://github.com/paulc/dnslib/commit/76e8677699ed098387d502c57980f58da642aeba · Note
• https://github.com/paulc/dnslib · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/dnslib/PYSEC-2022-4.yaml · Note
• https://t.me/cibsecurity/35155 · Telegram Post
• https://github.com/advisories/GHSA-r478-c2pc-m7gx · Note