A vulnerability was found in GNU Libidn2 up to 2.1.x and classified as critical. Affected by this issue is an unknown part of the component Roudtrip Check Handler. The manipulation as part of a Unicode Character leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.

The weakness was shared 10/22/2019 (Website). The advisory is available at gitlab.com. This vulnerability is handled as CVE-2019-12290 since 05/22/2019. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 2.2.0 eliminates this vulnerability.

Productinfo

Vendor

• GNU

Name

• Libidn2

Version

• 2.0
• 2.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion