Lucene search

[email protected]CVE-2023-31130

HistoryMay 25, 2023 - 10:15 p.m.

CVE-2023-31130

2023-05-2522:15:09

CWE-787

CWE-124

[email protected]

web.nvd.nist.gov

274

c-ares

asynchronous resolver library

buffer underflow

cve-2023-31130

nvd

security

vulnerability

fix

ares_inet_net_pton

ipv6 addresses

6.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular “0::00:00:00/2” was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.

Affected configurations

Vulners

NVD

Node

c-aresc-aresRange<1.19.1

VendorProductVersionCPE
c\-aresc\-ares*cpe:2.3:a:c\-ares:c\-ares:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
c\-ares	c\-ares	*	cpe:2.3:a:c\-ares:c\-ares::::::::

CNA Affected

[
  {
    "vendor": "c-ares",
    "product": "c-ares",
    "versions": [
      {
        "version": "< 1.19.1",
        "status": "affected"
      }
    ]
  }
]