CVE-2023-32067

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

Security Fix(es):

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.(CVE-2023-32067)

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple

Security Fix(es):

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.(CVE-2023-32067)

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple

Security Fix(es):

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.(CVE-2023-32067)

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple

Security Fix(es):

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.(CVE-2023-32067)

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.(CVE-2023-31147)

Security Fix(es):

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.(CVE-2023-32067)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)

• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)

• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)

• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)

• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: denial of service via a 0-length UDP packet
  • debian/patches/CVE-2023-32067.patch: in read_udp_packets() in ares_process.c, treat a 0-length UDP read as a 0-length packet and keep reading instead of tearing the server connection down; only a negative return value is now an error, and an answer from a mismatched address no longer stops the read loop.
  • CVE-2023-32067

These are all security issues fixed in the c-ares-devel-1.19.1-1.1 package on the GA media of openSUSE Tumbleweed.

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)

• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)

• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for c-ares fixes the following issues:

Update to version 1.19.1:

• CVE-2023-32067: 0-byte UDP payload causes Denial of Service (bsc#1211604)
• CVE-2023-31147: Insufficient randomness in generation of DNS query IDs (bsc#1211605)
• CVE-2023-31130: Buffer Underwrite in ares_inet_net_pton() (bsc#1211606)
• CVE-2023-31124: AutoTools does not set CARES_RANDOM_FILE during cross compilation (bsc#1211607)
• Fix uninitialized memory warning in test
• ares_getaddrinfo() should allow a port of 0
• Fix memory leak in ares_send() on error
• Fix comment style in ares_data.h
• Fix typo in ares_init_options.3
• Sync ax_pthread.m4 with upstream
• Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support

This update for libcares2 fixes the following issues:

• CVE-2023-32067: Fixed a denial of service that could be triggered by a 0-byte UDP payload (bsc#1211604).
• CVE-2023-31147: Fixed an insufficient randomness in generation of DNS query IDs (bsc#1211605).
• CVE-2023-31130: Fixed a buffer underflow when configuring specific IPv6 addresses (bsc#1211606).
• CVE-2023-31124: Fixed a build issue when cross-compiling that could lead to insufficient randomness (bsc#1211607).

This update for nodejs16 fixes the following issues:

Update to version 16.20.1:

• CVE-2023-30581: Fixed mainModule.proto Bypass Experimental Policy Mechanism (bsc#1212574).
• CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (bsc#1212579).
• CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates (bsc#1212581).
• CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
• CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
• CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE (bsc#1211607).
• CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
• CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
• CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).

Bug fixes:

• Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build failures on some platforms, like s390x in Factory. (bsc#1211407)