CVE-2022-4904

Description

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Affected products

Vendor	Product	Affected	Fixed
—	c-ares	unknown	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	c-ares	1.18.1-2	—
Debian 13	c-ares	1.18.1-2	—
Debian 12	c-ares	1.18.1-2	—
Debian 10	c-ares	1.14.0-1+deb10u2	DLA-3323-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	c-ares	1.34.6-1ubuntu0.2	USN-8951-1
Ubuntu 24.04 LTS	c-ares	1.27.0-1.0ubuntu1.1	USN-8951-1
Ubuntu 22.04 LTS	c-ares	1.18.1-1ubuntu0.22.04.1	USN-8951-1, USN-5907-1
Ubuntu 20.04 LTS	c-ares	1.15.0-1ubuntu0.2	USN-5907-1
Ubuntu 18.04 LTS	c-ares	1.14.0-1ubuntu0.2	USN-5907-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 20.04 LTS	c-ares	1.15.0-1ubuntu0.5+esm1	USN-8951-1
Ubuntu Pro 18.04 LTS	c-ares	1.14.0-1ubuntu0.2+esm3	USN-8951-1
Ubuntu Pro 16.04 LTS	c-ares	1.10.0-3ubuntu0.2+esm4	USN-8951-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	c-ares +1	1.19.1-1.el9	RHSA-2023:6635
RHEL 9	nodejs +3	1:16.19.1-1.el9_2	RHSA-2023:2655, RHSA-2023:2654
RHEL 9	nodejs-devel	1:18.14.2-2.module+el9.2.0.z+18497+a402347c	RHSA-2023:2654
RHEL 9	nodejs-nodemon	2.0.20-2.module+el9.2.0.z+18497+a402347c	RHSA-2023:2655, RHSA-2023:2654
RHEL 9	nodejs-packaging +1	2021.06-4.module+el9.1.0+15718+e52ec601	RHSA-2023:2654
RHEL 9	npm	1:8.19.3-1.16.19.1.1.el9_2	RHSA-2023:2655, RHSA-2023:2654
RHEL 8	c-ares +1	1.13.0-8.el8	RHSA-2023:7116
RHEL 8	nodejs +3	1:14.21.3-1.module+el8.7.0+18531+81d21ca6	RHSA-2023:4035, RHSA-2023:1743, RHSA-2023:1582
RHEL 8	nodejs-nodemon	2.0.20-2.module+el8.8.0+18432+27f188ac	RHSA-2023:4035, RHSA-2023:1743, RHSA-2023:1582
RHEL 8	nodejs-packaging	23-3.module+el8.3.0+6519+9f98ed83	RHSA-2023:4035, RHSA-2023:1743, RHSA-2023:1582
RHEL 8	nodejs-packaging-bundler	2021.06-4.module+el8.7.0+15582+19c314fa	RHSA-2023:4035
RHEL 8	npm	1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6	RHSA-2023:4035, RHSA-2023:1743, RHSA-2023:1582
RHEL 3	rh-nodejs14 +2	3.6-2.el7	RHSA-2023:1744
RHEL 3	rh-nodejs14-nodejs +3	14.21.3-2.el7	RHSA-2023:1744
RHEL 3	rh-nodejs14-npm	6.14.18-14.21.3.2.el7	RHSA-2023:1744

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.2 EUS	c-ares +1	1.17.1-5.el9_2.2	RHSA-2023:7368
RHEL 9.0 EUS	c-ares +1	1.17.1-5.el9_0.2	RHSA-2023:6291
RHEL 9.0 EUS	nodejs +3	1:16.20.2-1.el9_0	RHSA-2023:5533
RHEL 9.0 EUS	npm	1:8.19.4-1.16.20.2.1.el9_0	RHSA-2023:5533
RHEL 8.8 EUS	c-ares +1	1.13.0-6.el8_8.3	RHSA-2023:7543
RHEL 8.6 EUS	nodejs +3	1:14.21.3-1.module+el8.6.0+18532+cbe6f646	RHSA-2023:1742
RHEL 8.6 EUS	nodejs-nodemon	2.0.20-3.module+el8.6.0+18532+cbe6f646	RHSA-2023:1742
RHEL 8.6 EUS	nodejs-packaging	23-3.module+el8.3.0+6519+9f98ed83	RHSA-2023:1742
RHEL 8.6 EUS	npm	1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646	RHSA-2023:1742
RHEL 8.4 EUS	nodejs +3	1:14.21.3-1.module+el8.4.0+18317+43f5ac16	RHSA-2023:1533
RHEL 8.4 EUS	nodejs-nodemon	2.0.20-3.module+el8.4.0+18317+43f5ac16	RHSA-2023:1533
RHEL 8.4 EUS	nodejs-packaging	23-3.module+el8.3.0+6519+9f98ed83	RHSA-2023:1533
RHEL 8.4 EUS	npm	1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16	RHSA-2023:1533

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	c-ares +1	1.19.1-1.el9	ALSA-2023:6635
AlmaLinux 9	nodejs +3	1:16.19.1-1.el9_2	ALSA-2023:2655, ALSA-2023:2654
AlmaLinux 9	nodejs-devel	1:18.14.2-2.module_el9.2.0+29+de583a0b	ALSA-2023:2654
AlmaLinux 9	nodejs-nodemon	2.0.20-2.module_el9.2.0+29+de583a0b	ALSA-2023:2654
AlmaLinux 9	nodejs-packaging +1	2021.06-4.module_el9.1.0+13+d9a595ea	ALSA-2023:2654
AlmaLinux 9	npm	1:8.19.3-1.16.19.1.1.el9_2	ALSA-2023:2655, ALSA-2023:2654
AlmaLinux 8	c-ares +1	1.13.0-8.el8	ALSA-2023:7116
AlmaLinux 8	nodejs +3	1:14.21.3-1.module_el8.7.0+3551+53700ee8	ALSA-2023:4035, ALSA-2023:1743, ALSA-2023:1582
AlmaLinux 8	nodejs-nodemon	2.0.20-2.module_el8.8.0+3587+ee652244	ALSA-2023:4035, ALSA-2023:1743, ALSA-2023:1582
AlmaLinux 8	nodejs-packaging	23-3.module_el8.4.0+2522+3bd42762	ALSA-2023:4035, ALSA-2023:1743, ALSA-2023:1582
AlmaLinux 8	nodejs-packaging-bundler	2021.06-4.module_el8.7.0+3343+ea2b7901	ALSA-2023:4035
AlmaLinux 8	npm	1:6.14.18-1.14.21.3.1.module_el8.7.0+3551+53700ee8	ALSA-2023:4035, ALSA-2023:1743, ALSA-2023:1582

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	nodejs	1:16.19.1-1.el9_2	RLSA-2023:2655
Rocky Linux 9	nodejs-nodemon	2.0.20-3.el9_2	RLSA-2023:2655
Rocky Linux 9	nodejs-packaging	2021.06-4.module+el9.7.0+40017+f0db1785	RLSA-2023:2654
Rocky Linux 8	nodejs	1:14.21.3-1.module+el8.7.0+1183+c2c35f0a	RLSA-2023:4035, RLSA-2023:1743, RLSA-2023:1582
Rocky Linux 8	nodejs-nodemon	2.0.20-2.module+el8.7.0+1177+510ae886	RLSA-2023:4035, RLSA-2023:1743, RLSA-2023:1582
Rocky Linux 8	nodejs-packaging	23-3.module+el8.7.0+1071+4bdda2a8	RLSA-2023:4035, RLSA-2023:1743, RLSA-2023:1582

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLES 15 SP3	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLES 15 SP2	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLES 15 SP1	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLES 12 SP5	libcares2	1.9.1-9.15.1	SUSE-SU-2023:3420-1

Show 15 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP3	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLES for SAP 15 SP2	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLES for SAP 15 SP1	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLES for SAP 12 SP5	libcares2	1.9.1-9.15.1	SUSE-SU-2023:3420-1
SLE Real Time 15 SP3	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLE Micro 5.3	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLE Micro 5.2	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLE Micro 5.1	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLE HPC 15 SP3	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLE HPC 15 SP2	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SLE HPC 15 SP1	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SUSE Manager Server 4.2	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SUSE Manager Proxy 4.2	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SUSE Enterprise Storage 7.1	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1
SUSE Enterprise Storage 7	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	c-ares	1.19.0-2.1	openSUSE-SU-2024:12674-1
openSUSE Leap 15.4	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
openSUSE Leap Micro 5.3	c-ares	1.19.0-150000.3.20.1	SUSE-SU-2023:0486-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	c-ares +1	1.19.0-1.amzn2023	ALAS2023-2023-198
Amazon Linux 2023	nodejs +4	1:18.12.1-1.amzn2023.0.6	ALAS2023-2023-243
Amazon Linux 2023	npm	1:8.19.2-1.18.12.1.1.amzn2023.0.6	ALAS2023-2023-243
Amazon Linux 2023	v8-devel	2:10.2.154.15-1.18.12.1.1.amzn2023.0.6	ALAS2023-2023-243
Amazon Linux 2	c-ares +1	1.10.0-3.amzn2.0.4	ALAS2-2024-2399

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	grpc	1.62.0-2	—
Azure Linux 2 (CBL-Mariner)	c-ares	1.19.0-1	—
Azure Linux 2 (CBL-Mariner)	nodejs	16.20.1-2	—
Azure Linux 2 (CBL-Mariner)	python-gevent	21.1.2-3	—
Azure Linux 2 (CBL-Mariner)	python-pycares	No fix yet	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	c-ares +1	1.19.1-1.el9	ELSA-2023-6635
Oracle Linux 9	nodejs +3	1:16.19.1-1.el9_2	ELSA-2023-2655, ELSA-2023-2654
Oracle Linux 9	nodejs-devel	1:18.14.2-2.module+el9.2.0+21038+115df6a2	ELSA-2023-2654
Oracle Linux 9	nodejs-nodemon	2.0.20-2.module+el9.2.0+21038+115df6a2	ELSA-2023-2655, ELSA-2023-2654
Oracle Linux 9	nodejs-packaging +1	2021.06-4.module+el9.1.0+20762+f52d7401	ELSA-2023-2654
Oracle Linux 9	npm	1:8.19.3-1.16.19.1.1.el9_2	ELSA-2023-2655, ELSA-2023-2654
Oracle Linux 8	c-ares +1	1.13.0-8.el8	ELSA-2023-7116
Oracle Linux 8	nodejs +3	1:14.21.3-1.module+el8.7.0+21031+52889874	ELSA-2023-4035, ELSA-2023-1743, ELSA-2023-1582
Oracle Linux 8	nodejs-nodemon	2.0.20-2.module+el8.8.0+21122+857852f8	ELSA-2023-4035, ELSA-2023-1743, ELSA-2023-1582
Oracle Linux 8	nodejs-packaging	23-3.module+el8.3.0+7818+6cd30d85	ELSA-2023-4035, ELSA-2023-1743, ELSA-2023-1582
Oracle Linux 8	nodejs-packaging-bundler	2021.06-4.module+el8.7.0+20766+0a247725	ELSA-2023-4035
Oracle Linux 8	npm	1:6.14.18-1.14.21.3.1.module+el8.7.0+21031+52889874	ELSA-2023-4035, ELSA-2023-1743, ELSA-2023-1582

Advisories 47

ALSA-2023:6635 Moderate: c-ares security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:2654 Moderate: nodejs:18 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:2655 Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:7116 Moderate: c-ares security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:4035 Important: nodejs:18 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:1582 Moderate: nodejs:16 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:1743 Important: nodejs:14 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
USN-8951-1 c-ares vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
RHSA-2023:1742 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2023:2654 Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2023:2655 Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2023:1744 Red Hat Security Advisory: rh-nodejs14-nodejs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2023:1743 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2023:1582 Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2023:1533 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
WID-SEC-2023-2031 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
RHSA-2023:5533 Red Hat Security Advisory: nodejs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 9, 2026
WID-SEC-2023-2817 Red Hat Enterprise Linux: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 31, 2026
RHSA-2023:7543 Red Hat Security Advisory: c-ares security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2023:7368 Red Hat Security Advisory: c-ares security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2023:7116 Red Hat Security Advisory: c-ares security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2023:6635 Red Hat Security Advisory: c-ares security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2023:6291 Red Hat Security Advisory: c-ares security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2023:4035 Red Hat Security Advisory: nodejs:18 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
USN-5907-1 c-ares vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
DLA-3323-1 c-ares - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2023:1582 Moderate: nodejs:16 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
RLSA-2023:4035 Important: nodejs:18 security update Rocky Linux Security Advisories · Feb 5, 2026
RLSA-2023:1743 Important: nodejs:14 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
RLSA-2023:2655 Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
openSUSE-SU-2024:12674-1 c-ares-devel-1.19.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:3420-1 Security update for libcares2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:0486-1 Security update for c-ares SUSE / openSUSE Security Updates · Feb 4, 2026
RLSA-2023:2654 Moderate: nodejs:18 security, bug fix, and enhancement update Rocky Linux Security Advisories · Dec 3, 2025
ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300 CISA ICS & IT advisories · Feb 13, 2024
SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024
ALAS2-2024-2399 Moderate: c-ares security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 9, 2024
ELSA-2023-7116 Moderate: c-ares security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 17, 2023
ELSA-2023-6635 Moderate: c-ares security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2023
WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
ALAS2023-2023-243 Moderate: nodejs security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2023
ELSA-2023-4035 Important: nodejs:18 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 19, 2023
ALAS2023-2023-198 Important: c-ares security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 7, 2023
ELSA-2023-2655 Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 17, 2023
ELSA-2023-2654 Moderate: nodejs:18 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 17, 2023
ELSA-2023-1743 Important: nodejs:14 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 12, 2023
ELSA-2023-1582 Moderate: nodejs:16 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 5, 2023

References

https://bugzilla.redhat.com/show_bug.cgi?id=2168631
https://github.com/c-ares/c-ares/issues/496
FEDORA-2023-30e81e5293 vendor-advisory
GLSA-202401-02 vendor-advisory

EUVD	v3.1	8.6
CISA-ADP	v3.1	8.6

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a poss…

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Amazon Linux

Azure Linux

Oracle Linux

Advisories 47

References