GHSA-82r6-8w77-94w6: Pip/anyio vulnerability
Impact Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp() or directly via TLSStream.wrap() where the connection has (through other means) been hijacked and redirected to a malicious server. The attacker would obtain a legitimate certificate using the IDNA 2003 encoded version of the domain name and offer it to the connecting client, making the certificate validate properly on the client's end.
Patches The vulnerability will be patched in v4.14.2.
Workarounds Encode host names via the idna package prior to connecting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/anyioto a version that resolves this vulnerability.Fixed in 4.14.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v4.14.2 - Configuration
Prior to connecting using AnyIO `connect_tcp()` or `TLSStream.wrap()`, encode any internationalized (non-ASCII) hostnames using the `idna` package.
AnyIO Host name encoding = Encode host names via the `idna` package prior to connecting
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Services that connect to internationalized, non-ASCII domain names using AnyIO's connect_tcp() or TLSStream.wrap() are potentially affected. The described risk depends on the connection having been hijacked and redirected to a malicious server.
What does an attacker need to make the TLS certificate validate?
The attacker needs to redirect the connection to a malicious server and obtain a legitimate certificate for the domain name's IDNA 2003-encoded form. That certificate can then validate on the client side.
What can be done before upgrading?
Encode host names with the idna package before connecting. The issue is scheduled to be patched in AnyIO v4.14.2.