CVE-2023-29483: 
Python vulnerability analysis and mitigation

The dnspython stub resolver (versions before 2.6.0) contains a vulnerability identified as CVE-2023-29483, also known as the 'TuDoor' attack. The vulnerability was discovered and disclosed in February 2024, affecting the DNS query processing functionality in dnspython. The vulnerability impacts systems using dnspython for DNS resolution, particularly when used with eventlet (DNS Python, Red Hat CVE).

The vulnerability exists in the DNS pre-processing pipeline where the UDP processing functions in query.py and asyncquery.py accept the first-arriving packet before closing the receiving socket. The issue allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port before a legitimate response arrives. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium), with attack vector: Network, attack complexity: High, and high impact on availability (Snyk Report, NVD Entry).

When successfully exploited, the vulnerability can lead to a denial of service (DoS) condition for DNS resolution requests. In affected scenarios, dnspython might either switch to querying another resolver or give up entirely, potentially denying service for that specific resolution. This can disrupt DNS resolution services and affect the availability of targeted domains or services (Red Hat CVE, DNS Python Release).

The vulnerability requires an attacker to have the ability to predict or manipulate the timing of DNS responses and forge packets with the correct address and port. While the attack complexity is considered high, Snyk has indicated the existence of a proof-of-concept or detailed explanation of how to exploit this vulnerability. The attack can be executed remotely without requiring any privileges or user interaction (Snyk Report).

The primary mitigation is to upgrade dnspython to version 2.6.1 or higher. Version 2.6.0 initially addressed the vulnerability but contained a bug that was fixed in 2.6.1. The fix involves modifying the DNS resolution algorithm to ignore bad packets and continue listening for a legitimate response until the query timeout expires. For systems unable to upgrade immediately, pinning eventlet to versions before 2.6.0 can serve as a temporary mitigation, though this leaves the system vulnerable to the potential DoS (DNS Python, GitHub Issue).

The vulnerability has received attention from major organizations and security vendors. NetApp has issued an advisory investigating the impact on their products, and Red Hat has classified it as having a moderate severity impact. The eventlet team has been actively working on patches to address the compatibility issues with the new dnspython versions that include the fix (NetApp Advisory, GitHub Discussion).