{"id":"CVE-2020-22217","aliases":["ALSA-2023:7207","AZL-28597","DEBIAN-CVE-2020-22217","DLA-3567-1","EUVD-2020-14982","GHSA-88q4-8vpj-fqpg","RHSA-2023:7207","RHSA-2024:0419","RHSA-2024:0578","RLSA-2023:7207","SUSE-SU-2023:3690-1","UBUNTU-CVE-2020-22217","USN-6376-1","USN-8951-1"],"status":"published","title":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function...","description":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00977,"percentile":0.62618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-787"],"published":"2023-08-22T00:00:00Z","modified":"2026-10-29T11:02:19Z","fixes":[{"ecosystem":"Azure Linux:2","package":"python-gevent","fixed_in":["21.1.2-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"c-ares","fixed_in":["1.17.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"c-ares","fixed_in":["1.17.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"c-ares","fixed_in":["1.17.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"c-ares","fixed_in":["1.14.0-1+deb10u4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"c-ares","fixed_in":["0:1.13.0-6.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"c-ares-debuginfo","fixed_in":["0:1.13.0-6.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"c-ares-debugsource","fixed_in":["0:1.13.0-6.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"c-ares-devel","fixed_in":["0:1.13.0-6.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"c-ares","fixed_in":["0:1.13.0-6.el8_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"c-ares-debuginfo","fixed_in":["0:1.13.0-6.el8_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"c-ares-debugsource","fixed_in":["0:1.13.0-6.el8_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"c-ares-devel","fixed_in":["0:1.13.0-6.el8_8.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libcares2","fixed_in":["1.9.1-9.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libcares2","fixed_in":["1.9.1-9.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libcares2","fixed_in":["1.9.1-9.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"libcares2","fixed_in":["1.9.1-9.18.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c-ares","fixed_in":["1.10.0-3ubuntu0.2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c-ares","fixed_in":["1.14.0-1ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"c-ares","fixed_in":["1.15.0-1ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-9.el8_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-9.el8_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-gevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.2-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1+deb10u4"}]}],"versions":["1.14.0-1","1.14.0-1+deb10u1","1.14.0-1+deb10u2","1.14.0-1+deb10u3"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-9.el8_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"c-ares-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-9.el8_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"c-ares-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-9.el8_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-9.el8_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-6.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"c-ares-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-6.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"c-ares-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-6.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-6.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-6.el8_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"c-ares-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-6.el8_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"c-ares-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-6.el8_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-6.el8_8.4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.0-9.el8_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-9.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-9.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-9.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-9.18.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3ubuntu0.2+esm4"}]}],"versions":["1.10.0-2","1.10.0-3","1.10.0-3ubuntu0.1","1.10.0-3ubuntu0.2","1.10.0-3ubuntu0.2+esm1","1.10.0-3ubuntu0.2+esm2","1.10.0-3ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu0.2+esm3"}]}],"versions":["1.13.0-2","1.13.0-3","1.14.0-1","1.14.0-1ubuntu0.1","1.14.0-1ubuntu0.2","1.14.0-1ubuntu0.2+esm1","1.14.0-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-1ubuntu0.4"}]}],"versions":["1.15.0-1build1","1.15.0-1ubuntu0.1","1.15.0-1ubuntu0.2","1.15.0-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-1ubuntu0.4"}]}],"versions":["1.15.0-1build1","1.15.0-1ubuntu0.1","1.15.0-1ubuntu0.2","1.15.0-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3ubuntu0.2+esm4"}]}],"versions":["1.10.0-2","1.10.0-3","1.10.0-3ubuntu0.1","1.10.0-3ubuntu0.2","1.10.0-3ubuntu0.2+esm1","1.10.0-3ubuntu0.2+esm2","1.10.0-3ubuntu0.2+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu0.2+esm3"}]}],"versions":["1.13.0-2","1.13.0-3","1.14.0-1","1.14.0-1ubuntu0.1","1.14.0-1ubuntu0.2","1.14.0-1ubuntu0.2+esm1","1.14.0-1ubuntu0.2+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-1ubuntu0.5+esm1"}]}],"versions":["1.15.0-1build1","1.15.0-1ubuntu0.1","1.15.0-1ubuntu0.2","1.15.0-1ubuntu0.3","1.15.0-1ubuntu0.4","1.15.0-1ubuntu0.5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1ubuntu0.22.04.4"}]}],"versions":["1.17.1-1ubuntu1","1.18.1-1","1.18.1-1build1","1.18.1-1ubuntu0.22.04.1","1.18.1-1ubuntu0.22.04.2","1.18.1-1ubuntu0.22.04.3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-1.0ubuntu1.1"}]}],"versions":["1.19.1-3","1.20.1-1","1.26.0-1","1.27.0-1","1.27.0-1.0ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.6-1ubuntu0.2"}]}],"versions":["1.34.5-1","1.34.6-1","1.34.6-1ubuntu0.1"],"bundled":4}],"products":[{"vendor":"c-ares","product":"c-ares"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://github.com/c-ares/c-ares/issues/333","tags":["x_transferred","Exploit","Issue Tracking","Patch","fix","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00014.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-22217","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-88q4-8vpj-fqpg"},{"url":"https://access.redhat.com/errata/RHSA-2023:7207","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-22217","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-31130","tags":["report"]},{"url":"https://bugzilla.redhat.com/2209497","tags":["report"]},{"url":"https://bugzilla.redhat.com/2235527","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7207.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-22217","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209497","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235527","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7207.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-22217","tags":["advisory","report"]},{"url":"https://github.com/c-ares/c-ares/pull/332","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31130","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0419","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0419.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0578","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0578.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:7207","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233690-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214674","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-22217","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-22217","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6376-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8951-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-4904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-69184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-69186","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-22217","description":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2024-10-03T19:59:30.808Z","updated_at":"2026-11-02T14:35:46.873079Z"}],"euvd":[{"id":"EUVD-2020-14982","description":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2024-10-03T19:59:30Z","updated_at":"2026-11-03T00:27:53.790276Z"}],"ghsa":[{"id":"GHSA-88q4-8vpj-fqpg","title":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function...","description":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","status":"published","published":"2023-08-22T21:30:25Z","modified":"2024-04-04T07:06:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:56:48.229282Z"}],"nvd":[{"id":"CVE-2020-22217","description":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","status":"published","published":"2023-08-22T19:16:19.05Z","modified":"2026-06-17T03:04:11.493Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:47.910346Z"}],"osv":[{"id":"AZL-28597","title":"CVE-2020-22217 affecting package python-gevent for versions less than 21.1.2-1","description":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","status":"published","published":"2023-08-22T19:16:19Z","modified":"2026-04-21T04:25:53.228466Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"CVE-2020-22217","description":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","status":"published","published":"2023-08-22T19:16:19.05Z","modified":"2026-10-20T10:52:48.144586863Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:15.534837Z"},{"id":"DEBIAN-CVE-2020-22217","description":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","status":"published","published":"2023-08-22T19:16:19.05Z","modified":"2026-10-26T12:02:39.330663715Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"RHSA-2023:7207","title":"Red Hat Security Advisory: c-ares security update","status":"published","published":"2024-09-16T13:34:29Z","modified":"2026-08-07T10:10:54Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2024:0419","title":"Red Hat Security Advisory: c-ares security update","status":"published","published":"2024-09-16T13:34:38Z","modified":"2026-08-07T10:12:03Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0578","title":"Red Hat Security Advisory: c-ares security update","status":"published","published":"2024-09-16T13:34:47Z","modified":"2026-08-07T10:12:14Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"UBUNTU-CVE-2020-22217","description":"Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.","status":"published","published":"2023-08-22T19:16:00Z","modified":"2026-10-21T23:11:56.409511679Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"ALSA-2023:7207","title":"Moderate: c-ares security update","description":"The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.\n\nSecurity Fix(es):\n\n* c-ares: Heap buffer over read in ares_parse_soa_reply (CVE-2020-22217)\n* c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.345131835Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"DLA-3567-1","title":"c-ares - security update","status":"published","published":"2023-09-15T00:00:00Z","modified":"2026-03-09T01:20:01.374624Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"RLSA-2023:7207","title":"Moderate: c-ares security update","description":"The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.\n\nSecurity Fix(es):\n\n* c-ares: Heap buffer over read in ares_parse_soa_reply (CVE-2020-22217)\n\n* c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-11-28T22:42:52.397971Z","modified":"2026-02-05T15:00:07.574689Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:3690-1","title":"Security update for libcares2","description":"This update for libcares2 fixes the following issues:\n\n- CVE-2020-22217: Fixed an out of bounds read in ares_parse_soa_reply(). (bsc#1214674)\n","status":"published","published":"2023-09-19T20:05:29Z","modified":"2026-02-04T04:10:42.911663Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6376-1","title":"c-ares vulnerability","description":"It was discovered that c-ares incorrectly parsed certain SOA replies. A\nremote attacker could possibly use this issue to cause c-res to crash,\nresulting in a denial of service.\n","status":"published","published":"2023-09-18T13:08:11Z","modified":"2026-04-27T16:51:19.724824Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-8951-1","title":"c-ares vulnerabilities","description":"It was discovered that c-ares incorrectly parsed certain SOA replies. A\nremote attacker could possibly use this issue to cause c-ares to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04 LTS\nand Ubuntu 18.04 LTS. (CVE-2020-22217)\n\nIt was discovered that c-ares incorrectly handled certain sortlist strings.\nA remote attacker could possibly use this issue to cause c-ares to crash,\nresulting in a denial of service, or execute arbitrary code. This issue\nonly affected Ubuntu 16.04 LTS. (CVE-2022-4904)\n\nIt was discovered that c-ares did not properly limit DNS compression\npointer hops or assembled name lengths when parsing DNS names. A remote\nattacker could possibly use this issue to cause c-ares to use excessive\nresources, resulting in a denial of service. (CVE-2026-69184)\n\nIt was discovered that c-ares did not properly validate record count fields\nbefore allocating memory when parsing DNS responses. A remote attacker\ncould possibly use this issue to cause c-ares to use excessive resources,\nresulting in a denial of service. This issue only affected Ubuntu 24.04 LTS\nand Ubuntu 26.04 LTS. (CVE-2026-69186)","status":"published","published":"2026-10-21T18:20:42Z","modified":"2026-10-22T04:42:58.035678055Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}