CVE-2023-31130

Description

c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.

Weakness classification

• security-advisories@github.com: CWE-124
• nvd@nist.gov: CWE-787

Primary references

• security-advisories@github.com — Release Notes
• security-advisories@github.com — Third Party Advisory
• security-advisories@github.com — Mailing List
• security-advisories@github.com — Mailing List, Third Party Advisory
• security-advisories@github.com — Mailing List, Third Party Advisory
• security-advisories@github.com — Third Party Advisory
• security-advisories@github.com
• security-advisories@github.com — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory