Search for vulnerabilities
Vulnerability details: VCID-jvyw-e7te-aaam
Vulnerability ID VCID-jvyw-e7te-aaam
Aliases CVE-2023-31147
GHSA-8r8p-23f3-64c2
Summary c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-330 Use of Insufficiently Random Values
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-31147.json
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00116 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00145 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
epss 0.00197 https://api.first.org/data/v1/epss?cve=CVE-2023-31147
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.9 https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1
ssvc Track https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1
cvssv3.1 5.9 https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2
ssvc Track https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2
cvssv3.1 5.9 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/
cvssv3.1 5.9 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2023-31147
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2023-31147
cvssv3.1 5.9 https://security.gentoo.org/glsa/202310-09
ssvc Track https://security.gentoo.org/glsa/202310-09
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-31147.json
https://api.first.org/data/v1/epss?cve=CVE-2023-31147
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31147
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1
https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/
2209501 https://bugzilla.redhat.com/show_bug.cgi?id=2209501
cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
CVE-2023-31147 https://nvd.nist.gov/vuln/detail/CVE-2023-31147
GLSA-202310-09 https://security.gentoo.org/glsa/202310-09
RHSA-2023:3577 https://access.redhat.com/errata/RHSA-2023:3577
RHSA-2023:3586 https://access.redhat.com/errata/RHSA-2023:3586
RHSA-2023:4033 https://access.redhat.com/errata/RHSA-2023:4033
RHSA-2023:4034 https://access.redhat.com/errata/RHSA-2023:4034
RHSA-2023:4035 https://access.redhat.com/errata/RHSA-2023:4035
RHSA-2023:4036 https://access.redhat.com/errata/RHSA-2023:4036
RHSA-2023:4039 https://access.redhat.com/errata/RHSA-2023:4039
RHSA-2023:6635 https://access.redhat.com/errata/RHSA-2023:6635
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-31147.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-16T18:25:39Z/ Found at https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-16T18:25:39Z/ Found at https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-16T18:25:39Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-16T18:25:39Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-31147
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-31147
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://security.gentoo.org/glsa/202310-09
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-16T18:25:39Z/ Found at https://security.gentoo.org/glsa/202310-09
Exploit Prediction Scoring System (EPSS)
Percentile 0.26331
EPSS Score 0.00087
Published At June 12, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.