Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 7 enterprise_linux:7::client | c-ares | 0:1.10.0-3.el7_9.1 |
| Red Hat · RHEL 7 enterprise_linux:7::client | c-ares-debuginfo | 0:1.10.0-3.el7_9.1 |
| Red Hat · RHEL 7 enterprise_linux:7::client | c-ares-devel | 0:1.10.0-3.el7_9.1 |
| Red Hat · RHEL 7 enterprise_linux:7::computenode | c-ares-debuginfo | 0:1.10.0-3.el7_9.1 |
| Red Hat · RHEL 7 enterprise_linux:7::computenode | c-ares-devel | 0:1.10.0-3.el7_9.1 |
| Red Hat · RHEL 7 enterprise_linux:7::server | c-ares | 0:1.10.0-3.el7_9.1 |
| Red Hat · RHEL 7 enterprise_linux:7::server | c-ares-debuginfo | 0:1.10.0-3.el7_9.1 |
| Red Hat · RHEL 7 enterprise_linux:7::server | c-ares-devel | 0:1.10.0-3.el7_9.1 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | c-ares | 0:1.10.0-3.el7_9.1 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | c-ares-debuginfo | 0:1.10.0-3.el7_9.1 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | c-ares-devel | 0:1.10.0-3.el7_9.1 |
Vulnerabilities 1
-
High 7.5
0-byte UDP payload DoS in c-ares
c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously i…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2209502
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3741.json
-
report
https://access.redhat.com/security/cve/CVE-2023-32067
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-32067
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-32067
-
article
https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc