Threats affecting pkg:pypi/dnspython

dnspython versions prior to 2.9.0 contain an uncontrolled recursion vulnerability in the dns.name.from_wire_parser function. This function follows DNS compression pointer chains without a hop limit, allowing a malicious DNS message to cause excessive pointer traversal. This can lead to high CPU usage, application degradation, or denial of service. The issue is fixed in dnspython version 2.9.0.

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.