CVE-2019-12290
HighCVSS 7.5Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.
Risk Assessment
Domain impersonation can lead to phishing, traffic interception, and confidentiality breaches of user data, potentially harming the organization's reputation and causing financial losses.
Recommendation
Update libidn2 to version 2.2.0 or later, which includes a fix for this issue.
Other vulnerabilities in GNU libidn2
Original NVD description (English source)
GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS