Summary
The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.
Security Fix(es):
* c-ares: Heap buffer over read in ares_parse_soa_reply (CVE-2020-22217)
* c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | c-ares | 1.13.0-9.el8_9.1 |
| AlmaLinux · 8 | c-ares-devel | 1.13.0-9.el8_9.1 |
Vulnerabilities 2
-
Medium 4.1
Buffer Underwrite in ares_inet_net_pton()
c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes wh…
-
Unscored —
Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_r…