CVE-2019-12290

Name of the Vulnerable Software and Affected Versions GNU libidn2 versions prior to 2.2.0

Description The issue exists due to insufficient input validation in the RFC3490 component of the Libidn2 library. This can be exploited by a remote attacker to create a malicious domain that impersonates a target domain. By creating a domain that matches the target except for certain Unicode characters encoded in punycode, an attacker can impersonate arbitrary domains.

Recommendations For GNU libidn2 versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of punycode conversions to minimize the risk of domain impersonation.