CVE-2024-12224 — idna accepts Punycode labels that do not produce any non-ASCII when decoded

CVE-2024-12224

idna accepts Punycode labels that do not produce any non-ASCII when decoded PUBLISHED

Description (CNA)

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

Affected (CNA)

Vendor / product	Versions
servo / rust-url	affected 0 before 1.0.0

CWE

CWE-1289

References

https://rustsec.org/advisories/RUSTSEC-2024-0421.html
https://bugzilla.mozilla.org/show_bug.cgi?id=1887898

ADP enrichment

CISA-ADP

No English description supplied.

https://bugzilla.mozilla.org/show_bug.cgi?id=1887898