Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: < 2.9.2
Patched in 2.9.2
Details
A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion.
The from_text() parser does not check that a WKS record service number is between 0 and 65535 inclusive. It then uses this number to resize the bitmap to accommodate a bit with that offset. This can cause extremely large memory allocations, and also extends the array very inefficiently, wasting CPU.
This demonstrates the failure to limit the service number, though with a value that does not cause excessive memory or CPU consumption.
rd = dns.rdata.from_text("IN", "WKS", "10.0.0.1 udp 65536")
If dnspython is used to read zonefile format where the attacker can control the type and rdata text, the program may consume excessive memory or CPU, denying service.
More pip advisories
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.