CVE-2023-31147

2023-05-2522:15:09

CWE-330

[email protected]

web.nvd.nist.gov

191

c-ares

asynchronous resolver

cve-2023-31147

security vulnerability

rand()

rc4

csprng

dns query

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.1%

JSON

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.

Affected configurations

Vulners

NVD

Node

c-aresc-aresRange<1.19.1

VendorProductVersionCPE
c\-aresc\-ares*cpe:2.3:a:c\-ares:c\-ares:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
c\-ares	c\-ares	*	cpe:2.3:a:c\-ares:c\-ares::::::::

CNA Affected

[
  {
    "vendor": "c-ares",
    "product": "c-ares",
    "versions": [
      {
        "version": "< 1.19.1",
        "status": "affected"
      }
    ]
  }
]