USN-6780-1: idna vulnerability
Published May 21, 2024
·Updated
Guido Vranken discovered that idna did not properly manage certain inputs, which could lead to significant resource consumption. An attacker could possibly use this issue to cause a denial of service.
Affected Software
22 affected componentsFixes available
All of the following
ubuntu/python3-idna<3.6-2ubuntu0.1
3.6-2ubuntu0.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/python3-idna<3.3-2ubuntu0.1
3.3-2ubuntu0.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/python3-idna<3.3-1ubuntu0.1
3.3-1ubuntu0.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/python-idna<2.8-1ubuntu0.1
2.8-1ubuntu0.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/python3-idna<2.8-1ubuntu0.1
2.8-1ubuntu0.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/pypy-idna<2.6-1ubuntu0.1~esm1
2.6-1ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/python-idna<2.6-1ubuntu0.1~esm1
2.6-1ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/python3-idna<2.6-1ubuntu0.1~esm1
2.6-1ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/pypy-idna<2.0-3ubuntu0.1~esm1
2.0-3ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
All of the following
ubuntu/python-idna<2.0-3ubuntu0.1~esm1
2.0-3ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
All of the following
ubuntu/python3-idna<2.0-3ubuntu0.1~esm1
2.0-3ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
Event History
May 21, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-6780-1?
USN-6780-1 has a high severity level due to the potential for denial of service.
2
How do I fix USN-6780-1?
To fix USN-6780-1, upgrade the python3-idna or related packages to the specified remedial versions listed in the advisory.
3
What products are affected by USN-6780-1?
USN-6780-1 affects multiple Ubuntu products including 16.04, 18.04, 20.04, 22.04, 23.10, and 24.04.
4
What is the nature of the vulnerability in USN-6780-1?
The vulnerability in USN-6780-1 involves improper input management by idna, leading to significant resource consumption.
5
Can an attacker exploit the USN-6780-1 vulnerability remotely?
Yes, an attacker can exploit the USN-6780-1 vulnerability remotely to cause a denial of service.