Skip to main content

C Ares CVE-2023-31124

LOW
Use of Insufficiently Random Values (CWE-330)
2023-05-25 security-advisories@github.com
Information Disclosure Google C Ares Fedora
3.7
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.7 LOW
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
May 25, 2023 - 22:15 nvd
LOW 3.7

DescriptionNVD

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.

AnalysisAI

c-ares is an asynchronous resolver library. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-330. c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1. Affected products include: C-Ares Project C-Ares, Fedoraproject Fedora. Version information: version 1.19.1..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in C Ares

View all
CVE-2016-5180 CRITICAL
9.8 Oct 03

Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to caus
CVE-2021-3672 MEDIUM POC
5.6 Nov 23

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Se
CVE-2017-1000381 HIGH
7.5 Jul 07

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read me
CVE-2023-32067 HIGH
7.5 May 25

c-ares is an asynchronous resolver library. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,

CVE-2020-8277 HIGH
7.5 Nov 19

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial
CVE-2023-31147 MEDIUM
6.5 May 25

c-ares is an asynchronous resolver library. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable
CVE-2023-31130 MEDIUM
6.4 May 25

c-ares is an asynchronous resolver library. Rated medium severity (CVSS 6.4). No vendor patch available.
CVE-2025-62408 MEDIUM
5.9 Dec 08

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts whe

Same weakness CWE-330 – Use of Insufficiently Random Values

View all
CVE-2017-6026 CRITICAL POC
9.1
CVE-2022-36536 CRITICAL POC
9.8
CVE-2026-27637 CRITICAL POC
9.8
CVE-2022-44938 CRITICAL POC
9.8
CVE-2022-22922 CRITICAL POC
9.8
CVE-2021-41694 CRITICAL POC
9.8
CVE-2021-28024 CRITICAL POC
9.8
CVE-2021-27200 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-31124 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy