CVE-2019-12290

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-12290
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-12290.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-12290
Downstream
Related
Published
2019-10-22T16:15:10.877Z
Modified
2025-11-17T07:54:53.893755Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.

References

Affected packages

Git / github.com/libidn/libidn2

Affected ranges

Type
GIT
Repo
https://github.com/libidn/libidn2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3db6427d9ef42483405bfa75f234792ac073239e

Affected versions

libidn2-0.*

libidn2-0.10
libidn2-0.11
libidn2-0.12
libidn2-0.13
libidn2-0.14
libidn2-0.15
libidn2-0.16
libidn2-0.3
libidn2-0.4
libidn2-0.5
libidn2-0.6
libidn2-0.7
libidn2-0.8
libidn2-0.9

libidn2-2.*

libidn2-2.0.0
libidn2-2.0.1
libidn2-2.0.2
libidn2-2.0.3
libidn2-2.0.4
libidn2-2.0.5
libidn2-2.1.0
libidn2-2.1.1

Git / gitlab.com/libidn/libidn2

Affected ranges

Type
GIT
Repo
https://gitlab.com/libidn/libidn2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
241e8f486134793cb0f4a5b0e5817a97883401f5
Fixed
614117ef6e4c60e1950d742e3edf0a0ef8d389de

Affected versions

libidn2-0.*

libidn2-0.10
libidn2-0.11
libidn2-0.12
libidn2-0.13
libidn2-0.14
libidn2-0.15
libidn2-0.16
libidn2-0.3
libidn2-0.4
libidn2-0.5
libidn2-0.6
libidn2-0.7
libidn2-0.8
libidn2-0.9

libidn2-2.*

libidn2-2.0.0
libidn2-2.0.1
libidn2-2.0.2
libidn2-2.0.3
libidn2-2.0.4
libidn2-2.0.5
libidn2-2.1.0
libidn2-2.1.1

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "187845366280205581554916051824304641025",
                "289222033461961251682366936354811810929",
                "189921928984123963418844635464376916147",
                "32322299586069872753104641615897259259",
                "68915996413258629746358493254944318128",
                "295730367312914004971153892094774148693",
                "264258165042914839397875976476724874954",
                "163321080620791167400093219107764732189",
                "178771355685605208775915253908940624378",
                "161537723658831945381105479310787500612",
                "336132514217847844897387324679739871341",
                "125593242869440476194307051446470131116",
                "141317671660914381322152364271358431871",
                "214631645719211984927038159192097519376",
                "266587475166497327939218941668200906676",
                "314523723662684879250557283871182831196",
                "143571233016551291613287419848004828171",
                "334350992102930038829101961090464646085",
                "259178560879546280548176550449865355486",
                "228263717062548974924835271169699422705",
                "209557075922360947708273955807601980744",
                "298927573849399498727933349449060804764",
                "200870642929510662551358979060379372946",
                "83154842888797228375984819460951751371",
                "56736669590484047371391910641074305236",
                "312501796626787656415207348311880419549",
                "238390847104470054703256634220722141936",
                "178699996317677438489876796129231280301",
                "265343990960947131591128169558107137289",
                "20924633486555631153636335400639628014",
                "319020322763427148370536823242309996558",
                "37599245625922652816097075900812637469",
                "140851693938537637181819694478675077710",
                "162637764160326715175583723161150223839",
                "81206057916669312551064521823174789034",
                "90795475823384253914073336123682738196"
            ]
        },
        "source": "https://gitlab.com/libidn/libidn2@241e8f486134793cb0f4a5b0e5817a97883401f5",
        "id": "CVE-2019-12290-34a4fb6a",
        "target": {
            "file": "lib/lookup.c"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "196589049652805566618349219444565166789",
            "length": 1237.0
        },
        "source": "https://gitlab.com/libidn/libidn2@241e8f486134793cb0f4a5b0e5817a97883401f5",
        "id": "CVE-2019-12290-3a2bea05",
        "target": {
            "file": "lib/lookup.c",
            "function": "label"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "158323192680532173773353355260575223296",
            "length": 1609.0
        },
        "source": "https://gitlab.com/libidn/libidn2@241e8f486134793cb0f4a5b0e5817a97883401f5",
        "id": "CVE-2019-12290-47d0524e",
        "target": {
            "file": "src/idn2.c",
            "function": "usage"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "132847353310256968026952805416658069944",
            "length": 1689.0
        },
        "source": "https://gitlab.com/libidn/libidn2@241e8f486134793cb0f4a5b0e5817a97883401f5",
        "id": "CVE-2019-12290-7b9c9ae2",
        "target": {
            "file": "src/idn2.c",
            "function": "main"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "114932952402425713695135804304977684576"
            ]
        },
        "source": "https://gitlab.com/libidn/libidn2@241e8f486134793cb0f4a5b0e5817a97883401f5",
        "id": "CVE-2019-12290-88729c3d",
        "target": {
            "file": "src/blurbs.h"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "312356779681248897141270467858749709960",
            "length": 1929.0
        },
        "source": "https://gitlab.com/libidn/libidn2@241e8f486134793cb0f4a5b0e5817a97883401f5",
        "id": "CVE-2019-12290-89f31ec5",
        "target": {
            "file": "lib/error.c",
            "function": "idn2_strerror_name"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "66902672545539146513614053349137977493",
                "35705142242873268246961906559538162778",
                "92553056929671371861616070084439320737",
                "54063827184499356904768052335394235904",
                "41592960057154531973644757130155655068",
                "184195417186434568414504093915641920336",
                "53637315937563157046328503246039279430",
                "91854151707641435040215239355893114590"
            ]
        },
        "source": "https://gitlab.com/libidn/libidn2@241e8f486134793cb0f4a5b0e5817a97883401f5",
        "id": "CVE-2019-12290-a1de27eb",
        "target": {
            "file": "lib/error.c"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "87491573228088904306321158771688506918",
            "length": 2571.0
        },
        "source": "https://gitlab.com/libidn/libidn2@241e8f486134793cb0f4a5b0e5817a97883401f5",
        "id": "CVE-2019-12290-a7b50d06",
        "target": {
            "file": "lib/error.c",
            "function": "idn2_strerror"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "16217450268485728176248901353893967410",
            "length": 403.0
        },
        "source": "https://gitlab.com/libidn/libidn2@241e8f486134793cb0f4a5b0e5817a97883401f5",
        "id": "CVE-2019-12290-ca931a85",
        "target": {
            "file": "lib/lookup.c",
            "function": "set_default_flags"
        },
        "signature_version": "v1",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "166885763631888406267131528687096582745",
                "134367394057071990490085530265912699219",
                "214378052207718936395517494157405438190",
                "232115736145380109018108751105545165544",
                "224698098182131758138671533896448875293",
                "259038086519496779361696632459998164591",
                "6114980826271067092645779402511071784",
                "89644263389340556783706497584888941590",
                "165727711777409542780179600632295041520",
                "26230735817845700437729811762211287753",
                "32912217945566229435583919163839432422",
                "279461692832200392842104054395391354798",
                "315064635494576614957724199126787903121",
                "132472155916234525831925478258186666183",
                "142262658041150698465307422285829635768",
                "127809624820878683290662984068786164174",
                "310772457680198278739071035262824120750",
                "6059200163761477374636826095744790818",
                "199068233433028341871381895255198024036",
                "75417734971841325643407933153858414668",
                "331623842480580273871638426298658246517"
            ]
        },
        "source": "https://gitlab.com/libidn/libidn2@241e8f486134793cb0f4a5b0e5817a97883401f5",
        "id": "CVE-2019-12290-ede97f5a",
        "target": {
            "file": "src/idn2.c"
        },
        "signature_version": "v1",
        "deprecated": false
    }
]