medium
6.4
CWE
787 124 NVD-CWE-Other
Advisory Published
CVE Published
CVE Published
Updated

CVE-2023-31130: Buffer Underwrite in ares_inet_net_pton()

First published: Wed May 24 2023(Updated: )

ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). <a href="https://access.redhat.com/security/cve/CVE-2023-31130">CVE-2023-31130</a>. Moderate. Buffer Underwrite in ares_inet_net_pton() (<a href="https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v">https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v</a>)

Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
C-ares Project C-ares<1.19.1
Fedoraproject Fedora=37
Fedoraproject Fedora=38
ubuntu/c-ares<1.14.0-1ubuntu0.2+
1.14.0-1ubuntu0.2+
ubuntu/c-ares<1.10.0-3ubuntu0.2+
1.10.0-3ubuntu0.2+
ubuntu/c-ares<1.19.1<1.18.1-3
1.19.1
1.18.1-3
ubuntu/c-ares<1.15.0-1ubuntu0.3
1.15.0-1ubuntu0.3
ubuntu/c-ares<1.18.1-1ubuntu0.22.04.2
1.18.1-1ubuntu0.22.04.2
ubuntu/c-ares<1.18.1-1ubuntu0.22.10.2
1.18.1-1ubuntu0.22.10.2
ubuntu/c-ares<1.18.1-2ubuntu0.1
1.18.1-2ubuntu0.1
Debian Debian Linux=10.0
Debian Debian Linux=11.0
debian/c-ares<=1.14.0-1+deb10u1
1.14.0-1+deb10u4
1.17.1-1+deb11u3
1.18.1-3
1.26.0-1
IBM Cognos Analytics<=12.0.0-12.0.3
IBM Cognos Analytics<=11.2.0-11.2.4 FP4

Remedy

https://github.com/c-ares/c-ares/commit/f22cc01039b6473b736d3bf438f56a2654cdf2b2

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the vulnerability ID for this issue?

    The vulnerability ID for this issue is CVE-2023-31130.

  • What is the severity level of CVE-2023-31130?

    The severity level of CVE-2023-31130 is medium.

  • What is the affected software?

    The affected software includes c-ares versions up to and including 1.19.1, Fedora 37 and 38, and various versions of Ubuntu and Debian packages.

  • What is the description of CVE-2023-31130?

    CVE-2023-31130 is a vulnerability in c-ares library that allows a buffer underflow for certain IPv6 addresses.

  • How can I fix CVE-2023-31130?

    To fix CVE-2023-31130, update to a version of c-ares that is not affected by this vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203