CVE-2024-12224
EUVD-2024-347830.05.2025, 02:15
Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| servo | idna | 𝑥 < 1.0.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| gdk-pixbuf-loader-rsvg |
| ||||||||
| librav1e0_6 |
| ||||||||
| librsvg-2-2 |
| ||||||||
| librsvg-devel |
| ||||||||
| sevctl |
| ||||||||
| snpguest |
| ||||||||
| typelib-1_0-Rsvg-2_0 |
|
Common Weakness Enumeration
- CWE-1289 - Improper Validation of Unsafe Equivalence in InputThe product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
- CWE-352 - Cross-Site Request Forgery (CSRF)The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.