CVE-2024-3651 Denial of Service via Quadratic Complexity in kjd/idna
Attackers can cause denial of service in applications using the kjd/idna library by submitting crafted inputs that trigger quadratic complexity in the encoding function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-3651?
CVE-2024-3651 is a medium-severity denial of service vulnerability in kjd/idna, published on 7 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.
Weakness: CWE-1333
Which versions are affected by CVE-2024-3651?
3 open source packages ship an affected version, including idna. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
idna PyPI | All versions | 3.7 |
idna PyPI | All versions | 3.7 |
idna PyPI | From 0.1 | 3.7 |
Linux distribution packages (37)
python3-idna AlmaLinux:8 | All versions | 2.5-7.el8_10 |
python3-idna AlmaLinux:9 | All versions | 2.10-7.el9_4.1 |
python-idna Red Hat:enterprise_linux:8::baseos | All versions | 0:2.5-7.el8_10 |
python3-idna Red Hat:enterprise_linux:8::baseos | All versions | 0:2.5-7.el8_10 |
python-idna Red Hat:enterprise_linux:9::baseos | All versions | 0:2.10-7.el9_4.1 |
python3-idna Red Hat:enterprise_linux:9::baseos | All versions | 0:2.10-7.el9_4.1 |
python-idna Red Hat:rhel_aus:8.6::baseos | All versions | 0:2.5-5.el8_6.1 |
python3-idna Red Hat:rhel_aus:8.6::baseos | All versions | 0:2.5-5.el8_6.1 |
python-idna Red Hat:rhel_e4s:8.6::baseos | All versions | 0:2.5-5.el8_6.1 |
python3-idna Red Hat:rhel_e4s:8.6::baseos | All versions | 0:2.5-5.el8_6.1 |
python-idna Red Hat:rhel_els:7 | All versions | 0:2.4-2.el7_9 |
python-idna Red Hat:rhel_eus:8.8::baseos | All versions | 0:2.5-5.el8_8.1 |
python3-idna Red Hat:rhel_eus:8.8::baseos | All versions | 0:2.5-5.el8_8.1 |
python-idna Red Hat:rhel_tus:8.6::baseos | All versions | 0:2.5-5.el8_6.1 |
python3-idna Red Hat:rhel_tus:8.6::baseos | All versions | 0:2.5-5.el8_6.1 |
python-idna Rocky Linux:8 | All versions | 0:2.5-7.el8_10 |
python-idna Rocky Linux:9 | All versions | 0:2.10-7.el9_4.1 |
python-idna SUSE:Linux Enterprise Micro 5.1 | All versions | 2.6-150000.3.3.1 |
python-idna SUSE:Linux Enterprise Micro 5.2 | All versions | 2.6-150000.3.3.1 |
python-idna SUSE:Linux Enterprise Micro 5.3 | All versions | 2.6-150000.3.3.1 |
python-idna SUSE:Linux Enterprise Micro 5.4 | All versions | 2.6-150000.3.3.1 |
python-idna SUSE:Linux Enterprise Micro 5.5 | All versions | 2.6-150000.3.3.1 |
python-idna SUSE:Linux Enterprise Micro 5.5 | All versions | 2.6-150000.3.3.1 |
python-idna SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 2.6-150000.3.3.1 |
python-idna SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 2.5-3.13.1 |
python-idna SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.4-150400.11.10.1 |
python-idna SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 3.4-150400.11.10.1 |
python-idna SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 3.4-150400.11.10.1 |
python-idna SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.5-3.13.1 |
python-idna SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.5-3.13.1 |
python-idna openSUSE:Leap 15.5 | All versions | 2.6-150000.3.3.1 |
python-idna openSUSE:Leap 15.5 | All versions | 3.4-150400.11.10.1 |
python-idna openSUSE:Leap 15.6 | All versions | 3.4-150400.11.10.1 |
python-idna openSUSE:Leap Micro 5.3 | All versions | 2.6-150000.3.3.1 |
python-idna openSUSE:Leap Micro 5.4 | All versions | 2.6-150000.3.3.1 |
python-idna openSUSE:Tumbleweed | All versions | 3.19-1.1 |
python-idna openSUSE:Tumbleweed | All versions | 3.7-1.1 |
Products include Kjd Internationalized Domain Names in Applications.
How do I fix CVE-2024-3651?
Upgrade idna to 3.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-3651 being exploited?
There is no known exploitation of CVE-2024-3651 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in kjd/idna
Sources
Also known as ALPINE-CVE-2024-3651, ALSA-2024:3846, ALSA-2024:4260, AZL-43201, AZL-43204, AZL-43207 and 39 more.