Debian alert DLA-3811-1 (python-idna)

From:
             
 
Guilhem Moulin <guilhem@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3811-1] python-idna security update
Date:
             
 
Wed, 08 May 2024 19:05:07 +0200
Message-ID:
             
 
<ZjuwwznA9sjMNLyL@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-3811-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
May 08, 2024                                  https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : python-idna
Version        : 2.6-1+deb10u1
CVE ID         : CVE-2024-3651
Debian Bug     : 1069127

Guido Vranken discovered an issue in python3-idna, a library to support
the Internationalized Domain Names in Applications (IDNA) protocol.  A
specially crafted argument to the idna.encode() function could consume
significant resources, which may lead to Denial of Service.

For Debian 10 buster, this problem has been fixed in version
2.6-1+deb10u1.

We recommend that you upgrade your python-idna packages.

For the detailed security status of python-idna please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-idna

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmY7sMMACgkQ05pJnDwh
pVKMvQ//dbFz93sMT7swf8VFWAn/a10TfCLbVX7WRnB2m72W/O0/v/m708j6Yxqb
ZarOfFnwnCV7KJ6x91mq3iDYy2+LLn8zLlkl422+2SZrdLcTfYFyiVfUqrt468om
3T3FxNFGmixhWvZqyz6oWkmZYSiO8iRBBdrU1nCxdigz76VoPmXt/9X7HkOQRrEr
vbQQ00E/4jHhaPjagKL77P06IR5KfTZlPI608JsG0Lp6cf3K9RY6YgvkifrDvLk2
/gf6V9YsNA8gHpbfU/tWIRXQbUlZG9NYQKKADU2X/ITleqrD8BJEnyqTJs/+qg6E
0LMrOwOE/stOone4tQ4YcKw2dLiFQ1CQdIRvVgBHVuaXVE9Jhj4TOMhxX6VBWCOz
GMgAb7CvnK+gtAlDdpGTJa5Vnue+7Z9rwxsTsuHndTcAlzJmQ5al6qy1Sok+06Ek
pBMeQR7iG4iBg3M8xhrDKr9nQR5k6ZT2EA37X2wRxdTQFYra4anbdhHvAjrWR40i
+KYJ7jC0cyDB1n7imW4LMZteQKVJ981/+BlGZXqvH4I0wFbH8AN+/GQRdM4vfaIA
P9ogt+qFotJoF1Lkn2Yh+APhVsiR0RAfK2ngQqxHhwAER9Dxe3qYB67C5nwtXRW3
m5NhfcZQMxQHiKmuR5eaR+xTj3d+Z4e9KcA0JX7knu4Y7K+cGcQ=
=RgKB
-----END PGP SIGNATURE-----