CVE-2023-29483

Deeper analysis

The vulnerability is a DNS cache poisoning flaw, tracked as CVE-2023-29483, that affects eventlet versions prior to 0.35.2 when used by dnspython versions prior to 2.6.0. It stems from insufficient validation during UDP-based name resolution: the resolver accepts the first packet that matches the expected source IP and port without waiting for a valid response within the full timeout window, enabling an attacker to inject an invalid packet that disrupts subsequent lookups. The issue is assigned CWE-292 and carries a CVSS 3.1 score of 7.0.

An unauthenticated remote attacker who can observe or predict a DNS query can exploit the race condition by sending a single malformed UDP packet from the authoritative server’s IP address and port. Successful interference can cause the resolver to fail or return incorrect results, resulting in denial of service for dependent applications and limited impact on confidentiality and integrity of resolved data.

Patches are available in eventlet 0.35.2 and dnspython 2.6.1; the latter release also corrects an unrelated regression introduced in 2.6.0. Downstream distributions such as Fedora have issued coordinated updates referencing the upstream fixes. The associated EPSS score has remained essentially flat near 0.08 with no material post-disclosure increase.