Описание
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| azl3 application-gateway-kubernetes-ingress 1.7.7-3 on Azure Linux 3.0 | - | |
| azl3 azcopy 10.25.1-4 on Azure Linux 3.0 | - | |
| azl3 azurelinux-image-tools 1.2.0-2 on Azure Linux 3.0 | - | |
| azl3 cert-manager 1.12.15-6 on Azure Linux 3.0 | - | |
| azl3 cf-cli 8.7.11-5 on Azure Linux 3.0 | - | |
| azl3 cloud-provider-kubevirt 0.5.1-3 on Azure Linux 3.0 | - | |
| azl3 containerd2 2.1.6-2 on Azure Linux 3.0 | - | |
| azl3 containerized-data-importer 1.62.0-3 on Azure Linux 3.0 | - | |
| azl3 coredns 1.11.4-15 on Azure Linux 3.0 | - | |
| azl3 cri-tools 1.32.0-4 on Azure Linux 3.0 | - |
Показывать по
EPSS
10 Critical
CVSS3
Связанные уязвимости
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
The ToASCII and ToUnicode functions incorrectly accept Punycode-encode ...
EPSS
10 Critical
CVSS3