CVE-2023-31130

Katalog CVE

CVSS 6.4 · Medium EPSS 0,38%

Kerentanan Buffer Underwrite ('Buffer Underflow') pada c-ares project c-ares, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 6.4 (Medium) menurut NVD.

Deskripsi (NVD)

c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.

Rincian

Terbit di NVD

25 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-124: Buffer Underwrite ('Buffer Underflow')
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBB... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV2... mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202310-09 advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5419 advisory pihak ketiga
• https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1 release notes
• https://lists.debian.org/debian-lts-announce/2023/06/msg00034.html mailing list
• https://security.netapp.com/advisory/ntap-20240605-0005/