SUSE-SU-2023:2313-1: Security update for c-ares
This update for c-ares fixes the following issues: Update to version 1.19.1: CVE-2023-32067: 0-byte UDP payload causes Denial of Service (bsc#1211604) CVE-2023-31147: Insufficient randomness in generation of DNS query IDs (bsc#1211605) CVE-2023-31130: Buffer Underwrite in aresinetnetpton() (bsc#1211606) CVE-2023-31124: AutoTools does not set CARESRANDOMFILE during cross compilation (bsc#1211607) Fix uninitialized memory warning in test aresgetaddrinfo() should allow a port of 0 Fix memory leak in aressend() on error Fix comment style in aresdata.h Fix typo in aresinitoptions.3 Sync axpthread.m4 with upstream Sync axcxxcompilestdcxx11.m4 with upstream to fix uclibc support
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libcares2-debuginfoto a version that resolves this vulnerability.Fixed in 1.19.1-150000.3.23.1 - Upgrade
Upgrade
suse/c-ares-debugsourceto a version that resolves this vulnerability.Fixed in 1.19.1-150000.3.23.1 - Upgrade
Upgrade
suse/libcares2to a version that resolves this vulnerability.Fixed in 1.19.1-150000.3.23.1 - Upgrade
Upgrade
suse/c-ares-utilsto a version that resolves this vulnerability.Fixed in 1.19.1-150000.3.23.1 - Upgrade
Upgrade
suse/c-ares-develto a version that resolves this vulnerability.Fixed in 1.19.1-150000.3.23.1 - Upgrade
Upgrade
suse/c-ares-utils-debuginfoto a version that resolves this vulnerability.Fixed in 1.19.1-150000.3.23.1 - Upgrade
Upgrade
suse/libcares2to a version that resolves this vulnerability.Fixed in 32bit-debuginfo-1.19.1-150000.3.23.1 - Upgrade
Upgrade
suse/libcares2to a version that resolves this vulnerability.Fixed in 32bit-1.19.1-150000.3.23.1 - Upgrade
Upgrade
c-aresto a version that resolves this vulnerability.Fixed in 1.19.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.3-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.4-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP4-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP5-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-RT-15-SP3-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SUSE-MicroOS-5.1-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SUSE-MicroOS-5.2-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.3-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.4-2023-2313=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2023-2313=1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems and packages are covered by this update?
The update applies to openSUSE Leap Micro 5.3 on aarch64 and x86_64, and openSUSE Leap 15.4 on aarch64, ppc64le, s390x, and x86_64. Listed packages include libcares2, c-ares-devel, c-ares-utils, debugsource, and debuginfo packages.
What impact can the addressed vulnerabilities have?
The update addresses a denial-of-service condition triggered by a zero-byte UDP payload, insufficient randomness in DNS query IDs, and a buffer underwrite in ares_inet_net_pton(). It also fixes an issue where CARES_RANDOM_FILE is not set by AutoTools during cross-compilation.
What version does this update provide?
This security update updates c-ares to version 1.19.1.