CVE-2023-29483

Aliases:GHSA-3rq5-2g8h-59hc
Advisory lineage Upstream: 0 Downstream: 14
Modified
Published: 11 Apr 2024, 00:00
Last modified:04 Nov 2025, 17:12

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7 HIGH
v3.1 (cve.org)
EPSS Score
8.39% LOW
8% probability +3.43%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

11 Apr 2024, 00:00
Published
Vulnerability first disclosed
04 Nov 2025, 17:12
Last Modified
Vulnerability information updated

Description

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

CVSS Metrics

  • v3.1•HIGH•Score: 7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
  • v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 8.39%• Percentile: 92%

Techniques & Countermeasures

  • CWE-292•DEPRECATED: Trusting Self-reported DNS Name

    This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.

Affected Systems

  • dnspython•dnspython

    < 2.6.0

  • eventlet•eventlet

    < 0.35.2

  • fedoraproject•fedora

    38 | 39 | 40

  • netapp•bootstrap_os

    na

  • PyPI•dnspython

    < 2.6.1

  • PyPI•eventlet

    < 0.35.2

References (21)