CVE-2023-31124

2023-05-2522:15:09

Google

osv.dev

c-ares

resolver

vulnerability

patch

1.19.1

software

cross-compiling

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

36.5%

JSON

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.

CPENameOperatorVersion
c-areseq1.27.0-1.1
c-areseq1.17.1-1.1
c-areseqcurl-7_13_1
c-areseqcurl-7_13_2
c-areseqcares-1_9_1
c-areseqcurl-7_16_2
c-areseq1.24.0-1
c-areseq1.17.1-1+deb11u1
c-areseqcurl-7_20_0
c-areseqcares-1_7_5

Name	Operator	Version
c-ares	eq	1.27.0-1.1
c-ares	eq	1.17.1-1.1
c-ares	eq	curl-7_13_1
c-ares	eq	curl-7_13_2
c-ares	eq	cares-1_9_1
c-ares	eq	curl-7_16_2
c-ares	eq	1.24.0-1
c-ares	eq	1.17.1-1+deb11u1
c-ares	eq	curl-7_20_0
c-ares	eq	cares-1_7_5