Skip to content
OpenAdvisories
Low ALAS2-2024-2429 1 CVE

Low: c-ares security update (Amazon Linux 2)

Published Jan 19, 2024 · Updated Jan 22, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31124: When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 c-ares 0:1.10.0-3.amzn2.0.5
Amazon Linux · 2 c-ares-debuginfo 0:1.10.0-3.amzn2.0.5
Amazon Linux · 2 c-ares-devel 0:1.10.0-3.amzn2.0.5

Vulnerabilities 1

  • Low 3.7
    CVE-2023-31124

    AutoTools does not set CARES_RANDOM_FILE during cross compilation

    c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow …

    c-ares c-ares c-ares c-ares Debian Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-31124.html