Impersonation Vulnerability in GNU libidn2 Affects Domain Name Conversion

CVE-2019-12290

What is CVE-2019-12290?

A vulnerability in GNU libidn2 prior to version 2.2.0 allows attackers to impersonate arbitrary domains. This is achieved through insufficient validation checks during the conversion process from A-labels to U-labels as outlined in RFC3490 Section 4.2. By leveraging punycoded Unicode characters, an attacker can craft a malicious domain that appears similar to a legitimate domain. When these domains undergo the conversion process to Unicode labels and back to ASCII, certain characters may be discarded, facilitating the impersonation without triggering security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References