CVE-2022-4904

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple

Security Fix(es):

In ares_set_sortlist, it calls config_sortlist(..., sortstr) to parse the input str and initialize a sortlist configuration. However, ares_set_sortlist has not any checks about the validity of the input str. It is very easy to create an arbitrary length stack overflow with the unchecked memcpy(ipbuf, str, q-str); and memcpy(ipbufpfx, str, q-str); statements in the config_sortlist call, which could potentially cause severe security impact in practical programs.(CVE-2022-4904)

Security Fix(es):

In ares_set_sortlist, it calls config_sortlist(..., sortstr) to parse the input str and initialize a sortlist configuration. However, ares_set_sortlist has not any checks about the validity of the input str. It is very easy to create an arbitrary length stack overflow with the unchecked memcpy(ipbuf, str, q-str); and memcpy(ipbufpfx, str, q-str); statements in the config_sortlist call, which could potentially cause severe security impact in practical programs.(CVE-2022-4904)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

• glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

• http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

• Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

• Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

• Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

• Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

• Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)

• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)

• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

• glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
• http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
• Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
• Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
• Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
• Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
• Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.21.3).

Security Fix(es):

• decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)
• glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
• nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
• http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
• Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
• Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

• glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
• http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
• Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
• Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
• Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
• Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
• Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).

Security Fix(es):

• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
• http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
• Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
• Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
• Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
• Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

The following packages have been upgraded to a later upstream version: c-ares (1.19.1). (BZ#2210370)

Security Fix(es):

• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2022-4904: fix missing checks in ares_set_sortlist to prevent possible stack overflow

• CVE-2022-4904: fix stack overflow in ares_set_sortlist due to missing input validation

• CVE-2022-4904: fix stack overflow in ares_set_sortlist due to missing input validation

• CVE-2022-4904: fix stack overflow in ares_set_sortlist due to missing input validation

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

The config_sortlist function is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow and thus may cause a denial of service. (CVE-2022-4904)

These are all security issues fixed in the c-ares-devel-1.19.0-2.1 package on the GA media of openSUSE Tumbleweed.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

• glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

• http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

• Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

• Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

• Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

• Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

• Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.21.3).

Security Fix(es):

• decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)

• glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

• nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

• http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

• Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

• Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20).

Security Fix(es):

• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

• http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

• Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

• Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

• Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

• Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for c-ares fixes the following issues:

Updated to version 1.19.0:

• CVE-2022-4904: Fixed missing string length check in config_sortlist() (bsc#1208067).

This update for libcares2 fixes the following issues:

• CVE-2022-4904: Fixed stack overflow in ares_set_sortlist() (bsc#1208067).

It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could use this issue to cause c-ares to crash, resulting in a denial of service, or possibly execute arbitrary code.

It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-22217)

It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2022-4904)

It was discovered that c-ares did not properly limit DNS compression pointer hops or assembled name lengths when parsing DNS names. A remote attacker could possibly use this issue to cause c-ares to use excessive resources, resulting in a denial of service. (CVE-2026-69184)

It was discovered that c-ares did not properly validate record count fields before allocating memory when parsing DNS responses. A remote attacker could possibly use this issue to cause c-ares to use excessive resources, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-69186)