CVE-2023-31130
Fixed in a distro release EPSS <1%CVSS 4.1
c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.
Products: c-ares
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | c-ares | 1.13.0-9.el8_9.1 |
| AlmaLinux 8 | c-ares-devel | 1.13.0-9.el8_9.1 |
| AlmaLinux 8 | nodejs | 1:18.14.2-3.module_el8.8.0+3587+ee652244 |
| AlmaLinux 8 | nodejs | 1:16.19.1-2.module_el8.8.0+3586+d4fc0b72 |
| AlmaLinux 8 | nodejs-devel | 1:16.19.1-2.module_el8.8.0+3586+d4fc0b72 |
| AlmaLinux 8 | nodejs-devel | 1:18.14.2-3.module_el8.8.0+3587+ee652244 |
| AlmaLinux 8 | nodejs-docs | 1:16.19.1-2.module_el8.8.0+3586+d4fc0b72 |
| AlmaLinux 8 | nodejs-docs | 1:18.14.2-3.module_el8.8.0+3587+ee652244 |
| AlmaLinux 8 | nodejs-full-i18n | 1:18.14.2-3.module_el8.8.0+3587+ee652244 |
| AlmaLinux 8 | nodejs-full-i18n | 1:16.19.1-2.module_el8.8.0+3586+d4fc0b72 |
| AlmaLinux 8 | nodejs-nodemon | 2.0.20-2.module_el8.8.0+3587+ee652244 |
| AlmaLinux 8 | nodejs-nodemon | 2.0.20-3.module_el8.8.0+3586+d4fc0b72 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | nodejs-packaging | 25-1.module_el8.5.0+2605+45d748af |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | npm | 1:8.19.3-1.16.19.1.2.module_el8.8.0+3586+d4fc0b72 |
| AlmaLinux 8 | npm | 1:9.5.0-1.18.14.2.3.module_el8.8.0+3587+ee652244 |
| AlmaLinux 9 | c-ares | 1.19.1-1.el9 |
| AlmaLinux 9 | c-ares-devel | 1.19.1-1.el9 |
| AlmaLinux 9 | nodejs | 1:18.14.2-3.module_el9.2.0+30+e3312493 |
| AlmaLinux 9 | nodejs | 1:16.19.1-2.el9_2 |
| AlmaLinux 9 | nodejs-devel | 1:18.14.2-3.module_el9.2.0+30+e3312493 |
| AlmaLinux 9 | nodejs-docs | 1:18.14.2-3.module_el9.2.0+30+e3312493 |
| AlmaLinux 9 | nodejs-docs | 1:16.19.1-2.el9_2 |
| AlmaLinux 9 | nodejs-full-i18n | 1:18.14.2-3.module_el9.2.0+30+e3312493 |
| AlmaLinux 9 | nodejs-full-i18n | 1:16.19.1-2.el9_2 |
| AlmaLinux 9 | nodejs-libs | 1:16.19.1-2.el9_2 |
| AlmaLinux 9 | nodejs-nodemon | 2.0.20-2.module_el9.2.0+29+de583a0b |
| AlmaLinux 9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea |
| AlmaLinux 9 | npm | 1:9.5.0-1.18.14.2.3.module_el9.2.0+30+e3312493 |
| AlmaLinux 9 | npm | 1:8.19.3-1.16.19.1.2.el9_2 |
| Amazon Linux 2 | c-ares | 1.10.0-3.amzn2.0.4 |
| Amazon Linux 2 | c-ares-devel | 1.10.0-3.amzn2.0.4 |
| Amazon Linux 2023 | c-ares | 1.19.0-1.amzn2023 |
| Amazon Linux 2023 | c-ares-devel | 1.19.0-1.amzn2023 |
| Amazon Linux 2023 | ecs-service-connect-agent | v1.27.0.0-1.amzn2023 |
| Chainguard | c-ares | 1.19.1-r0 |
| Debian 10 | c-ares | 1.14.0-1+deb10u3 |
| Debian 11 | c-ares | 1.17.1-1+deb11u3 |
| Debian 12 | c-ares | 1.18.1-3 |
| Debian 13 | c-ares | 1.18.1-3 |
| Debian 14 | c-ares | 1.18.1-3 |
| Red Hat Enterprise Linux 8 | c-ares | 0:1.13.0-9.el8_9.1 |
| Red Hat Enterprise Linux 8 | c-ares-debuginfo | 0:1.13.0-9.el8_9.1 |
| Red Hat Enterprise Linux 8 | c-ares-debugsource | 0:1.13.0-9.el8_9.1 |
| Red Hat Enterprise Linux 8 | c-ares-devel | 0:1.13.0-9.el8_9.1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:16.19.1-2.module+el8.8.0+19038+6f60344f |
| Red Hat Enterprise Linux 8 | nodejs | 1:18.14.2-3.module+el8.8.0+19021+4b8b11cc |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:16.19.1-2.module+el8.8.0+19038+6f60344f |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:18.14.2-3.module+el8.8.0+19021+4b8b11cc |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:16.19.1-2.module+el8.8.0+19038+6f60344f |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:18.14.2-3.module+el8.8.0+19021+4b8b11cc |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:18.14.2-3.module+el8.8.0+19021+4b8b11cc |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:16.19.1-2.module+el8.8.0+19038+6f60344f |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:16.19.1-2.module+el8.8.0+19038+6f60344f |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:18.14.2-3.module+el8.8.0+19021+4b8b11cc |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:16.19.1-2.module+el8.8.0+19038+6f60344f |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:18.14.2-3.module+el8.8.0+19021+4b8b11cc |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:2.0.20-2.module+el8.8.0+18432+27f188ac |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:2.0.20-3.module+el8.8.0+19038+6f60344f |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+15582+19c314fa |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:25-1.module+el8.5.0+10992+fac5fe06 |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.7.0+15582+19c314fa |
| Red Hat Enterprise Linux 8 | npm | 1:9.5.0-1.18.14.2.3.module+el8.8.0+19021+4b8b11cc |
| Red Hat Enterprise Linux 8 | npm | 1:8.19.3-1.16.19.1.2.module+el8.8.0+19038+6f60344f |
| Red Hat Enterprise Linux 9 | c-ares | 0:1.19.1-1.el9 |
| Red Hat Enterprise Linux 9 | c-ares-debuginfo | 0:1.19.1-1.el9 |
| Red Hat Enterprise Linux 9 | c-ares-debugsource | 0:1.19.1-1.el9 |
| Red Hat Enterprise Linux 9 | c-ares-devel | 0:1.19.1-1.el9 |
| Red Hat Enterprise Linux 9 | nodejs | 1:16.19.1-2.el9_2 |
| Red Hat Enterprise Linux 9 | nodejs | 1:18.14.2-3.module+el9.2.0.z+18964+42696395 |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:16.19.1-2.el9_2 |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:18.14.2-3.module+el9.2.0.z+18964+42696395 |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:18.14.2-3.module+el9.2.0.z+18964+42696395 |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:16.19.1-2.el9_2 |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:18.14.2-3.module+el9.2.0.z+18964+42696395 |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:16.19.1-2.el9_2 |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:18.14.2-3.module+el9.2.0.z+18964+42696395 |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:18.14.2-3.module+el9.2.0.z+18964+42696395 |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:16.19.1-2.el9_2 |
| Red Hat Enterprise Linux 9 | nodejs-libs | 1:16.19.1-2.el9_2 |
| Red Hat Enterprise Linux 9 | nodejs-libs-debuginfo | 1:16.19.1-2.el9_2 |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:2.0.20-2.module+el9.2.0.z+18497+a402347c |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
| Red Hat Enterprise Linux 9 | npm | 1:9.5.0-1.18.14.2.3.module+el9.2.0.z+18964+42696395 |
| Red Hat Enterprise Linux 9 | npm | 1:8.19.3-1.16.19.1.2.el9_2 |
| Red Hat rhel eus 8.6 | c-ares | 0:1.13.0-6.el8_6.2 |
| Red Hat rhel eus 8.6 | c-ares-debuginfo | 0:1.13.0-6.el8_6.2 |
| Red Hat rhel eus 8.6 | c-ares-debugsource | 0:1.13.0-6.el8_6.2 |
| Red Hat rhel eus 8.6 | c-ares-devel | 0:1.13.0-6.el8_6.2 |
| Red Hat rhel eus 8.6 | nodejs | 1:16.19.1-2.module+el8.6.0+19139+7f27a8ff |
| Red Hat rhel eus 8.6 | nodejs-debuginfo | 1:16.19.1-2.module+el8.6.0+19139+7f27a8ff |
| Red Hat rhel eus 8.6 | nodejs-debugsource | 1:16.19.1-2.module+el8.6.0+19139+7f27a8ff |
| Red Hat rhel eus 8.6 | nodejs-devel | 1:16.19.1-2.module+el8.6.0+19139+7f27a8ff |
| Red Hat rhel eus 8.6 | nodejs-docs | 1:16.19.1-2.module+el8.6.0+19139+7f27a8ff |
| Red Hat rhel eus 8.6 | nodejs-full-i18n | 1:16.19.1-2.module+el8.6.0+19139+7f27a8ff |
| Red Hat rhel eus 8.6 | nodejs-nodemon | 0:2.0.20-3.module+el8.6.0+19139+7f27a8ff |
| Red Hat rhel eus 8.6 | nodejs-packaging | 0:25-1.module+el8.5.0+10992+fac5fe06 |
| Red Hat rhel eus 8.6 | npm | 1:8.19.3-1.16.19.1.2.module+el8.6.0+19139+7f27a8ff |
| Red Hat rhel eus 8.8 | c-ares | 0:1.13.0-6.el8_8.3 |
| Red Hat rhel eus 8.8 | c-ares-debuginfo | 0:1.13.0-6.el8_8.3 |
| Red Hat rhel eus 8.8 | c-ares-debugsource | 0:1.13.0-6.el8_8.3 |
| Red Hat rhel eus 8.8 | c-ares-devel | 0:1.13.0-6.el8_8.3 |
| Red Hat rhel eus 9.0 | nodejs | 1:16.18.1-4.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-debuginfo | 1:16.18.1-4.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-debugsource | 1:16.18.1-4.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-docs | 1:16.18.1-4.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-full-i18n | 1:16.18.1-4.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-libs | 1:16.18.1-4.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-libs-debuginfo | 1:16.18.1-4.el9_0 |
| Red Hat rhel eus 9.0 | npm | 1:8.19.2-1.16.18.1.4.el9_0 |
| Red Hat rhel software collections 3 | rh-nodejs14-nodejs | 0:14.21.3-4.el7 |
| Red Hat rhel software collections 3 | rh-nodejs14-nodejs-debuginfo | 0:14.21.3-4.el7 |
| Red Hat rhel software collections 3 | rh-nodejs14-nodejs-devel | 0:14.21.3-4.el7 |
| Red Hat rhel software collections 3 | rh-nodejs14-nodejs-docs | 0:14.21.3-4.el7 |
| Red Hat rhel software collections 3 | rh-nodejs14-nodejs-full-i18n | 0:14.21.3-4.el7 |
| Red Hat rhel software collections 3 | rh-nodejs14-npm | 0:6.14.18-14.21.3.4.el7 |
| Rocky Linux 8 | c-ares | 0:1.13.0-9.el8_9.1 |
| Rocky Linux 8 | nodejs | 1:16.19.1-2.module+el8.8.0+1338+00a07a77 |
| Rocky Linux 8 | nodejs | 1:18.14.2-3.module+el8.8.0+1337+7ea46b57 |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.20-2.module+el8.7.0+1177+510ae886 |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.20-3.module+el8.7.0+1178+d52dba78 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
| Rocky Linux 8 | nodejs-packaging | 0:25-1.module+el8.7.0+1108+49363b0d |
| Rocky Linux 9 | nodejs-nodemon | 0:2.0.20-2.module+el9.6.0+32048+5323bb50 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d |
| SUSE Enterprise Storage 7 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Enterprise Storage 7.1 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Enterprise Storage 7.1 | nodejs16 | 16.20.1-150300.7.24.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | nodejs16 | 16.20.1-150300.7.24.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | nodejs16 | 16.20.1-150300.7.24.2 |
| SUSE Linux Enterprise Micro 5.1 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Micro 5.2 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Micro 5.3 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Micro 5.4 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs16 | 16.20.1-8.30.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs18 | 18.16.1-8.9.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP4 | nodejs16 | 16.20.1-150400.3.21.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP4 | nodejs18 | 18.16.1-150400.9.9.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs18 | 18.16.1-150400.9.9.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | libcares2 | 1.9.1-9.12.1 |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | libcares2 | 1.9.1-9.12.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | libcares2 | 1.9.1-9.12.1 |
| SUSE Linux Enterprise Server 12 SP5 | libcares2 | 1.9.1-9.12.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | nodejs16 | 16.20.1-150300.7.24.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | libcares2 | 1.9.1-9.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | libcares2 | 1.9.1-9.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | nodejs16 | 16.20.1-150300.7.24.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | libcares2 | 1.9.1-9.12.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP5 | libcares2 | 1.9.1-9.12.1 |
| SUSE Manager Proxy 4.2 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Manager Server 4.2 | c-ares | 1.19.1-150000.3.23.1 |
| SUSE Manager Server 4.2 | nodejs16 | 16.20.1-150300.7.24.2 |
| SUSE OpenStack Cloud 9 | libcares2 | 1.9.1-9.12.1 |
| SUSE OpenStack Cloud Crowbar 9 | libcares2 | 1.9.1-9.12.1 |
| Ubuntu 20.04 LTS | c-ares | 1.15.0-1ubuntu0.3 |
| Ubuntu 22.04 LTS | c-ares | 1.18.1-1ubuntu0.22.04.2 |
| Ubuntu Pro 16.04 LTS | c-ares | 1.10.0-3ubuntu0.2+esm2 |
| Ubuntu Pro 18.04 LTS | c-ares | 1.14.0-1ubuntu0.2+esm1 |
| Wolfi | c-ares | 1.19.1-r0 |
| openSUSE Leap 15.4 | c-ares | 1.19.1-150000.3.23.1 |
| openSUSE Leap 15.4 | nodejs16 | 16.20.1-150400.3.21.1 |
| openSUSE Leap 15.4 | nodejs18 | 18.16.1-150400.9.9.1 |
| openSUSE Leap 15.5 | c-ares | 1.19.1-150000.3.23.1 |
| openSUSE Leap 15.5 | nodejs18 | 18.16.1-150400.9.9.1 |
| openSUSE Leap Micro 5.3 | c-ares | 1.19.1-150000.3.23.1 |
| openSUSE Tumbleweed | c-ares | 1.19.1-1.1 |