CVE-2023-31147

c-ares is an asynchronous resolver library. When /dev/urandom or
RtlGenRandom() are unavailable, c-ares uses rand() to generate random
numbers used for DNS query ids. This is not a CSPRNG, and it is also not
seeded by srand() so will generate predictable output. Input from the
random number generator is fed into a non-compilant RC4 implementation and
may not be as strong as the original RC4 implementation. No attempt is made
to look for modern OS-provided CSPRNGs like arc4random() that is widely
available. This issue has been fixed in version 1.19.1.

Notes