CVE-2023-31147

CVSS V2 None CVSS V3 None
Description
c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.
Overview
  • CVE ID
  • CVE-2023-31147
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-05-25T21:55:47.585Z
  • Last Modified Date
  • 2023-05-25T21:55:47.585Z
Weakness Enumerations
CWE URL
CWE-330 http://cwe.mitre.org/data/definitions/330.html
References
Reference URL Reference Tags
https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2 x_refsource_CONFIRM
https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1 x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/
https://security.gentoo.org/glsa/202310-09
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-31147
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31147
History
Created Old Value New Value Data Type Notes
2024-06-24 21:42:58 Added to TrackCVE