{"id":"UBUNTU-CVE-2019-12290","details":"GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.","modified":"2026-04-22T12:08:25.893280Z","published":"2019-10-22T16:15:00Z","related":["USN-4168-1"],"upstream":["CVE-2019-12290"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-12290"},{"type":"REPORT","url":"https://gitlab.com/libidn/libidn2/commit/241e8f486134793cb0f4a5b0e5817a97883401f5"},{"type":"REPORT","url":"https://gitlab.com/libidn/libidn2/commit/614117ef6e4c60e1950d742e3edf0a0ef8d389de"},{"type":"REPORT","url":"https://gitlab.com/libidn/libidn2/merge_requests/71"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-4168-1"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2019-12290"}],"affected":[{"package":{"name":"libidn2-0","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/libidn2-0@0.9-1ubuntu0.1~esm1?arch=source&distro=esm-infra-legacy/trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9-1","0.9-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.9-1ubuntu0.1~esm1","binary_name":"idn2"},{"binary_version":"0.9-1ubuntu0.1~esm1","binary_name":"libidn2-0"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-12290.json"}},{"package":{"name":"libidn2-0","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/libidn2-0@0.10-3ubuntu0.1~esm1?arch=source&distro=esm-apps/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10-3","0.10-3ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.10-3ubuntu0.1~esm1","binary_name":"idn2"},{"binary_version":"0.10-3ubuntu0.1~esm1","binary_name":"libidn2-0"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-12290.json"}},{"package":{"name":"libidn2","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libidn2@2.0.4-1.1ubuntu0.2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.1ubuntu0.2"}]}],"versions":["2.0.4-1","2.0.4-1.1","2.0.4-1.1build2"],"ecosystem_specific":{"binaries":[{"binary_version":"2.0.4-1.1ubuntu0.2","binary_name":"idn2"},{"binary_version":"2.0.4-1.1ubuntu0.2","binary_name":"libidn2-0"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-12290.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}]}