CVE-2019-12290
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2019-12290
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-12290.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2019-12290
- Related
- Published
- 2019-10-22T16:15:10Z
- Modified
- 2024-12-05T15:21:09.120791Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.
- References
-
- https://security.gentoo.org/glsa/202003-63
- https://gitlab.com/libidn/libidn2/commit/241e8f486134793cb0f4a5b0e5817a97883401f5
- https://gitlab.com/libidn/libidn2/merge_requests/71
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html
- https://gitlab.com/libidn/libidn2/commit/614117ef6e4c60e1950d742e3edf0a0ef8d389de
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFT76Y7OSGPZV3EBEHD6ISVUM3DLARM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KXDKYWFV6N2HHVSE67FFDM7G3FEL2ZNE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONG3GJRRJO35COPGVJXXSZLU4J5Y42AT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSI4TI2JTQWQ3YEUX5X36GTVGKO4QKZ5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6ZXL2RDNQRAHCMKWPOMJFKYJ344X4HL/
- https://usn.ubuntu.com/4168-1/
- https://security.alpinelinux.org/vuln/CVE-2019-12290
- https://security-tracker.debian.org/tracker/CVE-2019-12290
Affected packages
Alpine:v3.12 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:apk/alpine/libidn2?arch=source
Alpine:v3.13 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:apk/alpine/libidn2?arch=source
Alpine:v3.14 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:apk/alpine/libidn2?arch=source
Alpine:v3.15 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:apk/alpine/libidn2?arch=source
Alpine:v3.16 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:apk/alpine/libidn2?arch=source
Alpine:v3.17 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:apk/alpine/libidn2?arch=source
Alpine:v3.18 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:apk/alpine/libidn2?arch=source
Alpine:v3.19 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:apk/alpine/libidn2?arch=source
Alpine:v3.20 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:apk/alpine/libidn2?arch=source
Alpine:v3.21 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:apk/alpine/libidn2?arch=source
Debian:11 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:deb/debian/libidn2?arch=source
Debian:12 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:deb/debian/libidn2?arch=source
Debian:13 / libidn2
Package
- Name
- libidn2
- Purl
- pkg:deb/debian/libidn2?arch=source
Git / github.com/libidn/libidn2
Affected ranges
- Type
- GIT
- Repo
- https://github.com/libidn/libidn2
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- GIT
- Repo
- https://gitlab.com/libidn/libidn2
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
libidn2-0.*
libidn2-0.10
libidn2-0.11
libidn2-0.12
libidn2-0.13
libidn2-0.14
libidn2-0.15
libidn2-0.16
libidn2-0.3
libidn2-0.4
libidn2-0.5
libidn2-0.6
libidn2-0.7
libidn2-0.8
libidn2-0.9
libidn2-2.*
libidn2-2.0.0
libidn2-2.0.1
libidn2-2.0.2
libidn2-2.0.3
libidn2-2.0.4
libidn2-2.0.5
libidn2-2.1.0
libidn2-2.1.1