GHSA-82r6-8w77-94w6
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
Quick fix
GHSA-82r6-8w77-94w6 — anyio: upgrade to the fixed version with the command below.
pip install --upgrade 'anyio>=4.14.2'Details
### Impact Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's `connect_tcp()` or directly via `TLSStream.wrap()` where the connection has (through other means) been hijacked and redirected to a malicious server. The attacker would obtain a legitimate certificate using the IDNA 2003 encoded version of the domain name and offer it to the connecting client, making the certificate validate properly on the client's end.
### Patches The vulnerability will be patched in v4.14.2.
### Workarounds Encode host names via the `idna` package prior to connecting.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6[WEB]
- https://github.com/agronholm/anyio/pull/1208[WEB]
- https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce[WEB]
- https://github.com/agronholm/anyio[PACKAGE]
- https://github.com/agronholm/anyio/releases/tag/4.14.2[WEB]