CVE-2023-31130
Summary
| CVE | CVE-2023-31130 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-05-25 22:15:00 UTC |
|---|
| Updated | 2023-10-31 16:06:00 UTC |
|---|
| Description | c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 38 Update: c-ares-1.19.1-1.fc38 - package-announce - Fedora Mailing-Lists |
MISC |
lists.fedoraproject.org |
|
| Release 1.19.1 · c-ares/c-ares · GitHub |
MISC |
github.com |
|
| [SECURITY] [DLA 3471-1] c-ares security update |
MISC |
lists.debian.org |
|
| c-ares: Multiple Vulnerabilities (GLSA 202310-09) — Gentoo security |
MISC |
security.gentoo.org |
|
| Debian -- Security Information -- DSA-5419-1 c-ares |
MISC |
www.debian.org |
|
| Buffer Underwrite in ares_inet_net_pton() · Advisory · c-ares/c-ares · GitHub |
MISC |
github.com |
|
| [SECURITY] Fedora 37 Update: c-ares-1.19.1-1.fc37 - package-announce - Fedora Mailing-Lists |
MISC |
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160732 Oracle Enterprise Linux Security Update for nodejs (ELSA-2023-3586)
- 160740 Oracle Enterprise Linux Security Update for 18 (ELSA-2023-3577)
- 160788 Oracle Enterprise Linux Security Update for nodejs:16 (ELSA-2023-4034)
- 160794 Oracle Enterprise Linux Security Update for nodejs:18 (ELSA-2023-4035)
- 161099 Oracle Enterprise Linux Security Update for c-ares (ELSA-2023-6635)
- 161189 Oracle Enterprise Linux Security Update for c-ares (ELSA-2023-7207)
- 181829 Debian Security Update for c-ares (DSA 5419-1)
- 184880 Debian Security Update for c-ares (CVE-2023-31130)
- 199418 Ubuntu Security Notification for c-ares Vulnerabilities (USN-6164-1)
- 241702 Red Hat Update for nodejs:18 (RHSA-2023:3577)
- 241724 Red Hat Update for nodejs (RHSA-2023:3586)
- 241786 Red Hat Update for rh-nodejs14-nodejs (RHSA-2023:4039)
- 241787 Red Hat Update for nodejs (RHSA-2023:4036)
- 241788 Red Hat Update for nodejs:18 (RHSA-2023:4035)
- 241790 Red Hat Update for nodejs:16 (RHSA-2023:4033)
- 241792 Red Hat Update for nodejs:16 (RHSA-2023:4034)
- 242322 Red Hat Update for c-ares security (RHSA-2023:6635)
- 242447 Red Hat Update for c-ares (RHSA-2023:7207)
- 242524 Red Hat Update for c-ares (RHSA-2023:7543)
- 242613 Red Hat Update for c-ares (RHSA-2023:7392)
- 284001 Fedora Security Update for c (FEDORA-2023-ae97529c00)
- 284101 Fedora Security Update for c (FEDORA-2023-520848815b)
- 355414 Amazon Linux Security Advisory for c-ares : ALAS2023-2023-198
- 356117 Amazon Linux Security Advisory for ecs-service-connect-agent : ALAS2023-2023-344
- 356246 Amazon Linux Security Advisory for ecs-service-connect-agent : ALASECS-2023-007
- 356504 Amazon Linux Security Advisory for ecs-service-connect-agent : ALAS2ECS-2023-007
- 6000134 Debian Security Update for c-ares (DLA 3471-1)
- 673270 EulerOS Security Update for c-ares (EulerOS-SA-2023-2575)
- 673319 EulerOS Security Update for c-ares (EulerOS-SA-2023-2605)
- 673368 EulerOS Security Update for c-ares (EulerOS-SA-2023-2634)
- 673401 EulerOS Security Update for c-ares (EulerOS-SA-2023-2676)
- 673706 EulerOS Security Update for c-ares (EulerOS-SA-2023-3115)
- 673890 EulerOS Security Update for c-ares (EulerOS-SA-2023-2780)
- 674117 EulerOS Security Update for c-ares (EulerOS-SA-2023-2804)
- 710769 Gentoo Linux c-ares Multiple Vulnerabilities (GLSA 202310-09)
- 754046 SUSE Enterprise Linux Security Update for c-ares (SUSE-SU-2023:2313-1)
- 754083 SUSE Enterprise Linux Security Update for libcares2 (SUSE-SU-2023:2477-1)
- 754181 SUSE Enterprise Linux Security Update for nodejs16 (SUSE-SU-2023:2861-1)
- 906990 Common Base Linux Mariner (CBL-Mariner) Security Update for c-ares (26914-1)
- 907013 Common Base Linux Mariner (CBL-Mariner) Security Update for c-ares (26892-1)
- 907091 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (26938-1)
- 907299 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs18 (26940-1)
- 907580 Common Base Linux Mariner (CBL-Mariner) Security Update for fluent-bit (26917-1)
- 941145 AlmaLinux Security Update for nodejs (ALSA-2023:3586)
- 941153 AlmaLinux Security Update for nodejs:18 (ALSA-2023:3577)
- 941168 AlmaLinux Security Update for nodejs:16 (ALSA-2023:4034)
- 941169 AlmaLinux Security Update for nodejs:18 (ALSA-2023:4035)
- 941381 AlmaLinux Security Update for c-ares (ALSA-2023:6635)
- 941455 AlmaLinux Security Update for c-ares (ALSA-2023:7207)
- 960945 Rocky Linux Security Update for nodejs:18 (RLSA-2023:3577)
- 961083 Rocky Linux Security Update for c-ares (RLSA-2023:7207)
