CVE-2024-25629

EUVD-2024-22949
c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.4 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 27%
Affected Products (NVD)
VendorProductVersion
c-aresc-ares
𝑥
< 1.27.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
c-ares
bookworm
no-dsa
bullseye
no-dsa
bullseye (security)
vulnerable
buster
no-dsa
forky
1.34.6-1
fixed
sid
1.34.6-1
fixed
trixie
1.34.5-1
fixed
trixie (security)
1.34.5-1+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
c-ares
bionic
Fixed 1.14.0-1ubuntu0.2+esm2
released
focal
Fixed 1.15.0-1ubuntu0.5
released
jammy
Fixed 1.18.1-1ubuntu0.22.04.3
released
mantic
Fixed 1.19.1-3ubuntu0.1
released
trusty
ignored
xenial
Fixed 1.10.0-3ubuntu0.2+esm3
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
c-ares-devel
suse enterprise desktop 15 SP5
1.19.1-150000.3.26.1
fixed
suse enterprise desktop 15 SP6
1.19.1-150000.3.26.1
fixed
suse enterprise desktop 15 SP7
1.19.1-150000.3.26.1
fixed
suse enterprise sap 15 SP5
1.19.1-150000.3.26.1
fixed
suse enterprise sap 15 SP6
1.19.1-150000.3.26.1
fixed
suse enterprise sap 15 SP7
1.19.1-150000.3.26.1
fixed
suse enterprise server 15 SP5
1.19.1-150000.3.26.1
fixed
suse enterprise server 15 SP6
1.19.1-150000.3.26.1
fixed
suse enterprise server 15 SP7
1.19.1-150000.3.26.1
fixed
libcares2
suse enterprise desktop 15 SP5
1.19.1-150000.3.26.1
fixed
suse enterprise desktop 15 SP6
1.19.1-150000.3.26.1
fixed
suse enterprise desktop 15 SP7
1.19.1-150000.3.26.1
fixed
suse enterprise sap 15 SP5
1.19.1-150000.3.26.1
fixed
suse enterprise sap 15 SP6
1.19.1-150000.3.26.1
fixed
suse enterprise sap 15 SP7
1.19.1-150000.3.26.1
fixed
suse enterprise server 15 SP5
1.19.1-150000.3.26.1
fixed
suse enterprise server 15 SP6
1.19.1-150000.3.26.1
fixed
suse enterprise server 15 SP7
1.19.1-150000.3.26.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
c-ares
RHEL 8
0:1.13.0-11.el8_10
fixed
RHEL 9
0:1.19.1-2.el9_4
fixed
c-ares-devel
RHEL 8
0:1.13.0-11.el8_10
fixed
RHEL 9
0:1.19.1-2.el9_4
fixed
nodejs
RHEL 9
1:16.20.2-8.el9_4
fixed
nodejs-docs
RHEL 9
1:16.20.2-8.el9_4
fixed
nodejs-full-i18n
RHEL 9
1:16.20.2-8.el9_4
fixed
nodejs-libs
RHEL 9
1:16.20.2-8.el9_4
fixed
npm
RHEL 9
1:8.19.4-1.16.20.2.8.el9_4
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
c-ares
Amazon Linux 2
0:1.10.0-3.amzn2.0.6
fixed
Amazon Linux 2023
0:1.19.0-1.amzn2023.0.1
fixed
c-ares-debuginfo
Amazon Linux 2
0:1.10.0-3.amzn2.0.6
fixed
Amazon Linux 2023
0:1.19.0-1.amzn2023.0.1
fixed
c-ares-debugsource
Amazon Linux 2023
0:1.19.0-1.amzn2023.0.1
fixed
c-ares-devel
Amazon Linux 2
0:1.10.0-3.amzn2.0.6
fixed
Amazon Linux 2023
0:1.19.0-1.amzn2023.0.1
fixed
nodejs
Amazon Linux 2023
1:18.18.2-1.amzn2023.0.3
fixed
nodejs-debuginfo
Amazon Linux 2023
1:18.18.2-1.amzn2023.0.3
fixed
nodejs-debugsource
Amazon Linux 2023
1:18.18.2-1.amzn2023.0.3
fixed
nodejs-devel
Amazon Linux 2023
1:18.18.2-1.amzn2023.0.3
fixed
nodejs-docs
Amazon Linux 2023
1:18.18.2-1.amzn2023.0.3
fixed
nodejs-full-i18n
Amazon Linux 2023
1:18.18.2-1.amzn2023.0.3
fixed
nodejs-libs
Amazon Linux 2023
1:18.18.2-1.amzn2023.0.3
fixed
nodejs-libs-debuginfo
Amazon Linux 2023
1:18.18.2-1.amzn2023.0.3
fixed
nodejs-npm
Amazon Linux 2023
1:9.8.1-1.18.18.2.1.amzn2023.0.3
fixed
nodejs20
Amazon Linux 2023
1:20.11.1-1.amzn2023.0.2
fixed
nodejs20-debuginfo
Amazon Linux 2023
1:20.11.1-1.amzn2023.0.2
fixed
nodejs20-debugsource
Amazon Linux 2023
1:20.11.1-1.amzn2023.0.2
fixed
nodejs20-devel
Amazon Linux 2023
1:20.11.1-1.amzn2023.0.2
fixed
nodejs20-docs
Amazon Linux 2023
1:20.11.1-1.amzn2023.0.2
fixed
nodejs20-full-i18n
Amazon Linux 2023
1:20.11.1-1.amzn2023.0.2
fixed
nodejs20-libs
Amazon Linux 2023
1:20.11.1-1.amzn2023.0.2
fixed
nodejs20-libs-debuginfo
Amazon Linux 2023
1:20.11.1-1.amzn2023.0.2
fixed
nodejs20-npm
Amazon Linux 2023
1:10.2.4-1.20.11.1.1.amzn2023.0.2
fixed
v8-10.2-devel
Amazon Linux 2023
3:10.2.154.26-1.18.18.2.1.amzn2023.0.3
fixed
v8-11.3-devel
Amazon Linux 2023
3:11.3.244.8-1.20.11.1.1.amzn2023.0.2
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
c-ares
Azure Linux 3.0
0:1.30.0-1.azl3
fixed
CBL-Mariner 2.0
0:1.19.1-2.cm2
fixed
ceph
Azure Linux 3.0
0:18.2.2-1.azl3
fixed
fluent-bit
Azure Linux 3.0
0:3.0.6-1.azl3
fixed
CBL-Mariner 2.0
0:2.2.3-1.cm2
fixed
grpc
CBL-Mariner 2.0
0:1.42.0-9.cm2
fixed
nodejs
Azure Linux 3.0
0:20.14.0-1.azl3
fixed
nodejs18
CBL-Mariner 2.0
0:18.20.2-1.cm2
fixed
python-gevent
Azure Linux 3.0
0:23.9.1-4.azl3
fixed
CBL-Mariner 2.0
0:21.1.2-3.cm2
fixed
Common Weakness Enumeration
References
https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183
https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P76QYINQNPEHUTEEDOUYIRZ2X6UVZ5K/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSCMTSPDIE2UHU34TIXQQHZ6JTE3Y3VF/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX37LFPFQ3T6FFMMFYQTEGIQXXN7F27U/
https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183
https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P76QYINQNPEHUTEEDOUYIRZ2X6UVZ5K/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSCMTSPDIE2UHU34TIXQQHZ6JTE3Y3VF/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX37LFPFQ3T6FFMMFYQTEGIQXXN7F27U/