CVE-2023-31124

概要

参考情報

• c-ares/c-ares release cares-1_19_1 · Third Party Advisory
• c-ares/c-ares security advisory · Third Party Advisory
• lists.fedoraproject.org/archives/list/[email protected]/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY · Mailing List
• lists.fedoraproject.org/archives/list/[email protected]/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7 · Mailing List
• security.gentoo.org/glsa/202310-09 · Third Party Advisory

c-ares のその他の脆弱性

• CVE-2023-32067高 7.5c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forg…
• CVE-2023-31147中 6.5c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbe…
• CVE-2023-31130中 6.4c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particul…
• CVE-2022-4904高 8.6A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possi…
• CVE-2021-3672中 5.6A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to o…