VDB

GHSA-jjg7-2v4v-x38h

GHSA-jjg7-2v4v-x38h PUBLISHED CVSS 6.199999809265137 MEDIUM

Record from GitHub Advisory Database · Published April 11, 2024

idna is fixed in 3.7 (PyPI)

Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
idnaPyPI3.7
py3.11-pytorch-cuda-12.3Chainguard2.3.1-r6
py3-pipenvWolfi2024.4.1-r0
py3-torchvision-cuda-11.8Chainguard0.18.1-r3
py3-idnaChainguard3.7-r0
k8s-sidecarChainguard1.26.1-r1
jwt-toolChainguard2.2.7-r0
k8s-sidecar-1.22Chainguard1.22.4-r2
ggshieldWolfi1.27.0-r0
kserveWolfi0.13.1-r3
dask-gatewayWolfi2024.1.0-r4
kubeflow-pipelines-visualization-serverWolfi2.2.0-r0

33 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
6.199999809265137
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
PyPIidna0
chainguardpy3.11-pytorch-cuda-12.30
wolfipy3-pipenv0
chainguardpy3-torchvision-cuda-11.80
chainguardpy3-idna0
chainguardk8s-sidecar0
chainguardjwt-tool0
chainguardk8s-sidecar-1.220
wolfiggshield0
wolfikserve0
wolfidask-gateway0
wolfikubeflow-pipelines-visualization-server0
wolficonfluent-docker-utils0
chainguardkubeflow-pipelines0
wolficheckov0
chainguardkubeflow-pipelines-visualization-server0
chainguarddask-gateway0
chainguardcheckov0
wolfiaz0
chainguardggshield0

…and 26 more

Timeline

  • Apr 11, 2024 CVE Published
  • Mar 20, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-jjg7-2v4v-x38h
vulnetix vdb fixes GHSA-jjg7-2v4v-x38h

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-jjg7-2v4v-x38h/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›