VulnerableCode Package Details - pkg:deb/debian/c-ares@1.34.5-1

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-jvyw-e7te-aaam	c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.	CVE-2023-31147 GHSA-8r8p-23f3-64c2
VCID-nmcd-jnpw-aaaj	c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.	CVE-2024-25629
VCID-se1r-ejvf-aaar	c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.	CVE-2023-31124 GHSA-54xr-f67r-4pc4

Vulnerability

Summary

Aliases

VCID-jvyw-e7te-aaam

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.

CVE-2023-31147
GHSA-8r8p-23f3-64c2

VCID-nmcd-jnpw-aaaj

c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.

CVE-2024-25629

VCID-se1r-ejvf-aaar

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.

CVE-2023-31124
GHSA-54xr-f67r-4pc4

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-06-21T04:34:52.946707+00:00	Debian Importer	Fixing	VCID-jvyw-e7te-aaam	https://security-tracker.debian.org/tracker/data/json	36.1.3
2025-06-21T01:14:37.433844+00:00	Debian Importer	Fixing	VCID-nmcd-jnpw-aaaj	https://security-tracker.debian.org/tracker/data/json	36.1.3
2025-06-20T23:54:19.115019+00:00	Debian Importer	Fixing	VCID-se1r-ejvf-aaar	https://security-tracker.debian.org/tracker/data/json	36.1.3
2025-06-20T22:16:38.997049+00:00	Debian Importer	Fixing	VCID-jvyw-e7te-aaam	None	36.1.3
2025-06-20T20:01:15.080609+00:00	Debian Importer	Fixing	VCID-se1r-ejvf-aaar	None	36.1.3
2025-06-05T14:05:22.130688+00:00	Debian Importer	Fixing	VCID-se1r-ejvf-aaar	None	36.1.0
2025-04-21T23:43:29.968079+00:00	Debian Importer	Fixing	VCID-se1r-ejvf-aaar	None	36.0.0
2025-04-11T09:52:11.363592+00:00	Debian Importer	Fixing	VCID-nmcd-jnpw-aaaj	https://security-tracker.debian.org/tracker/data/json	36.0.0
2025-04-11T09:47:08.657980+00:00	Debian Importer	Fixing	VCID-jvyw-e7te-aaam	None	36.0.0
2025-04-11T09:46:51.298084+00:00	Debian Importer	Fixing	VCID-se1r-ejvf-aaar	https://security-tracker.debian.org/tracker/data/json	36.0.0
2025-04-11T09:14:45.634648+00:00	Debian Importer	Fixing	VCID-jvyw-e7te-aaam	https://security-tracker.debian.org/tracker/data/json	36.0.0