CVE-2024-3651

{"id": "CVE-2024-3651", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-07-07T18:15:09.827", "references": [{"url": "https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb", "tags": ["Exploit", "Patch"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en la librer\u00eda kjd/idna, espec\u00edficamente dentro de la funci\u00f3n `idna.encode()`, afectando a la versi\u00f3n 3.6. El problema surge del manejo por parte de la funci\u00f3n de cadenas de entrada manipuladas, lo que puede generar complejidad cuadr\u00e1tica y, en consecuencia, una condici\u00f3n de denegaci\u00f3n de servicio. Esta vulnerabilidad se activa por una entrada manipulada que hace que la funci\u00f3n `idna.encode()` procese la entrada con una carga computacional considerable, aumentando significativamente el tiempo de procesamiento de manera cuadr\u00e1tica en relaci\u00f3n con el tama\u00f1o de la entrada."}], "lastModified": "2024-07-11T14:58:01.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kjd:internationalized_domain_names_in_applications:3.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58AE756B-C46B-418C-A3CD-DD0CEE78ABB3"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}