Vulnerability Description
Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Servo | Idna | < 1.0.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1887898ExploitIssue Tracking
- https://rustsec.org/advisories/RUSTSEC-2024-0421.htmlThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1887898ExploitIssue Tracking
FAQ
What is CVE-2024-12224?
CVE-2024-12224 is a vulnerability with a CVSS score of 8.8 (HIGH). Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while ano...
How severe is CVE-2024-12224?
CVE-2024-12224 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-12224?
Check the references section above for vendor advisories and patch information. Affected products include: Servo Idna.