NA

CVE-2023-31124

Published: 25/05/2023 Updated: 31/10/2023
CVSS v3 Base Score: 3.7 | Impact Score: 1.4 | Exploitability Score: 2.2
VMScore: 0

Vulnerability Summary

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an malicious user to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

c-ares project c-ares

fedoraproject fedora 37

fedoraproject fedora 38

Vendor Advisories

Synopsis Important: nodejs:16 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Se ...
Synopsis Important: nodejs:18 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this upda ...
Synopsis Important: nodejs security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for nodejs is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as having a se ...
Synopsis Important: nodejs security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for nodejs is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Security has rated ...
Synopsis Important: nodejs:16 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this upda ...
Synopsis Important: rh-nodejs14-nodejs security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for rh-nodejs14-nodejs is now available for Red Hat Software CollectionsRed Hat Product Security has rated ...
Synopsis Important: nodejs:18 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this upda ...
Synopsis Moderate: c-ares security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for c-ares is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated th ...
When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG (CVE-2023-31124) ...
Wasmtime is a standalone runtime for WebAssembly Prior to versions 602, 701, and 801, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior This undefined behavior was found to cause runtime-level issues when compiled with LLVM 16 which causes some writes, which are cri ...
DescriptionThe MITRE CVE dictionary describes this issue as: c-ares is an asynchronous resolver library When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android This will downgrade to using rand() as a fallback which could allow an attacker to take advantage ...