CVE-2024-25629
Fixed in a distro release EPSS <1%CVSS 4.4
c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.
Products: c-ares
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | c-ares | 1.13.0-11.el8_10 |
| AlmaLinux 8 | c-ares-devel | 1.13.0-11.el8_10 |
| AlmaLinux 8 | nodejs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 |
| AlmaLinux 8 | nodejs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux 8 | nodejs-devel | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux 8 | nodejs-devel | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 |
| AlmaLinux 8 | nodejs-docs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux 8 | nodejs-docs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 |
| AlmaLinux 8 | nodejs-full-i18n | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux 8 | nodejs-full-i18n | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | npm | 1:10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux 8 | npm | 1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644 |
| AlmaLinux 9 | c-ares | 1.19.1-2.el9_4 |
| AlmaLinux 9 | c-ares-devel | 1.19.1-2.el9_4 |
| AlmaLinux 9 | nodejs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 |
| AlmaLinux 9 | nodejs | 1:16.20.2-8.el9_4 |
| AlmaLinux 9 | nodejs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 |
| AlmaLinux 9 | nodejs-devel | 1:18.20.2-2.module_el9.4.0+99+a01f7676 |
| AlmaLinux 9 | nodejs-devel | 1:20.12.2-2.module_el9.4.0+100+71fc9528 |
| AlmaLinux 9 | nodejs-docs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 |
| AlmaLinux 9 | nodejs-docs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 |
| AlmaLinux 9 | nodejs-docs | 1:16.20.2-8.el9_4 |
| AlmaLinux 9 | nodejs-full-i18n | 1:20.12.2-2.module_el9.4.0+100+71fc9528 |
| AlmaLinux 9 | nodejs-full-i18n | 1:18.20.2-2.module_el9.4.0+99+a01f7676 |
| AlmaLinux 9 | nodejs-full-i18n | 1:16.20.2-8.el9_4 |
| AlmaLinux 9 | nodejs-libs | 1:16.20.2-8.el9_4 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 |
| AlmaLinux 9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea |
| AlmaLinux 9 | nodejs-packaging | 2021.06-4.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 |
| AlmaLinux 9 | npm | 1:10.5.0-1.20.12.2.2.module_el9.4.0+100+71fc9528 |
| AlmaLinux 9 | npm | 1:10.5.0-1.18.20.2.2.module_el9.4.0+99+a01f7676 |
| Alpine 3.16 | c-ares | 1.19.1-r1 |
| Alpine 3.17 | c-ares | 1.19.1-r1 |
| Alpine 3.18 | c-ares | 1.19.1-r1 |
| Alpine 3.19 | c-ares | 1.27.0-r0 |
| Alpine 3.20 | c-ares | 1.27.0-r0 |
| Alpine 3.21 | c-ares | 1.27.0-r0 |
| Alpine 3.22 | c-ares | 1.27.0-r0 |
| Alpine 3.23 | c-ares | 1.27.0-r0 |
| Alpine 3.24 | c-ares | 1.27.0-r0 |
| Amazon Linux 2 | c-ares | 1.10.0-3.amzn2.0.6 |
| Amazon Linux 2 | c-ares-devel | 1.10.0-3.amzn2.0.6 |
| Amazon Linux 2023 | c-ares | 1.19.0-1.amzn2023.0.1 |
| Amazon Linux 2023 | c-ares-devel | 1.19.0-1.amzn2023.0.1 |
| Amazon Linux 2023 | nodejs | 1:18.18.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | nodejs-devel | 1:18.18.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | nodejs-docs | 1:18.18.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | nodejs-full-i18n | 1:18.18.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | nodejs-libs | 1:18.18.2-1.amzn2023.0.3 |
| Amazon Linux 2023 | nodejs-npm | 1:9.8.1-1.18.18.2.1.amzn2023.0.3 |
| Amazon Linux 2023 | nodejs20 | 1:20.11.1-1.amzn2023.0.2 |
| Amazon Linux 2023 | nodejs20-devel | 1:20.11.1-1.amzn2023.0.2 |
| Amazon Linux 2023 | nodejs20-docs | 1:20.11.1-1.amzn2023.0.2 |
| Amazon Linux 2023 | nodejs20-full-i18n | 1:20.11.1-1.amzn2023.0.2 |
| Amazon Linux 2023 | nodejs20-libs | 1:20.11.1-1.amzn2023.0.2 |
| Amazon Linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.2 |
| Amazon Linux 2023 | v8-10.2-devel | 3:10.2.154.26-1.18.18.2.1.amzn2023.0.3 |
| Amazon Linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.11.1.1.amzn2023.0.2 |
| Chainguard | c-ares | 1.27.0-r0 |
| Debian 12 | c-ares | no fix |
| Debian 13 | c-ares | 1.27.0-1 |
| Debian 14 | c-ares | 1.27.0-1 |
| Red Hat Enterprise Linux 8 | c-ares | 0:1.13.0-11.el8_10 |
| Red Hat Enterprise Linux 8 | c-ares-debuginfo | 0:1.13.0-11.el8_10 |
| Red Hat Enterprise Linux 8 | c-ares-debugsource | 0:1.13.0-11.el8_10 |
| Red Hat Enterprise Linux 8 | c-ares-devel | 0:1.13.0-11.el8_10 |
| Red Hat Enterprise Linux 8 | nodejs | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+21190+5ebd2c33 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+21190+5ebd2c33 |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+21190+5ebd2c33 |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | npm | 1:10.5.0-1.20.12.2.2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | npm | 1:10.5.0-1.18.20.2.1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 9 | c-ares | 0:1.19.1-2.el9_4 |
| Red Hat Enterprise Linux 9 | c-ares-debuginfo | 0:1.19.1-2.el9_4 |
| Red Hat Enterprise Linux 9 | c-ares-debugsource | 0:1.19.1-2.el9_4 |
| Red Hat Enterprise Linux 9 | c-ares-devel | 0:1.19.1-2.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-libs | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-libs-debuginfo | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0+19762+d716bf3b |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
| Red Hat Enterprise Linux 9 | npm | 1:10.5.0-1.18.20.2.2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | npm | 1:10.5.0-1.20.12.2.2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 |
| Red Hat rhel e4s 9.0 | nodejs | 1:16.20.2-9.el9_0 |
| Red Hat rhel e4s 9.0 | nodejs-debuginfo | 1:16.20.2-9.el9_0 |
| Red Hat rhel e4s 9.0 | nodejs-debugsource | 1:16.20.2-9.el9_0 |
| Red Hat rhel e4s 9.0 | nodejs-docs | 1:16.20.2-9.el9_0 |
| Red Hat rhel e4s 9.0 | nodejs-full-i18n | 1:16.20.2-9.el9_0 |
| Red Hat rhel e4s 9.0 | nodejs-libs | 1:16.20.2-9.el9_0 |
| Red Hat rhel e4s 9.0 | nodejs-libs-debuginfo | 1:16.20.2-9.el9_0 |
| Red Hat rhel e4s 9.0 | npm | 1:8.19.4-1.16.20.2.9.el9_0 |
| Red Hat rhel eus 9.2 | nodejs | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-debuginfo | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-debugsource | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-docs | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-full-i18n | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-libs | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-libs-debuginfo | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | npm | 1:8.19.4-1.16.20.2.6.el9_2.3 |
| Rocky Linux 8 | c-ares | 0:1.13.0-11.el8_10 |
| Rocky Linux 8 | nodejs | 1:20.12.2-2.module+el8.9.0+1804+2708cc21 |
| Rocky Linux 8 | nodejs | 1:18.20.2-1.module+el8.9.0+1803+9ac8b495 |
| Rocky Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
| Rocky Linux 9 | c-ares | 0:1.19.1-2.el9_4 |
| Rocky Linux 9 | nodejs | 1:16.20.2-8.el9_4 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Micro 5.1 | c-ares | 1.19.1-150000.3.26.1 |
| SUSE Linux Enterprise Micro 5.2 | c-ares | 1.19.1-150000.3.26.1 |
| SUSE Linux Enterprise Micro 5.3 | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Micro 5.3 | c-ares | 1.19.1-150000.3.26.1 |
| SUSE Linux Enterprise Micro 5.4 | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Micro 5.4 | c-ares | 1.19.1-150000.3.26.1 |
| SUSE Linux Enterprise Micro 5.5 | c-ares | 1.19.1-150000.3.26.1 |
| SUSE Linux Enterprise Micro 5.5 | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | c-ares | 1.19.1-150000.3.26.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Server 12 SP5 | libcares2 | 1.9.1-9.21.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | libcares2 | 1.9.1-9.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | c-ares | 1.34.8-150000.3.29.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | libcares2 | 1.9.1-9.21.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP5 | libcares2 | 1.9.1-9.21.1 |
| Ubuntu 20.04 LTS | c-ares | 1.15.0-1ubuntu0.5 |
| Ubuntu 22.04 LTS | c-ares | 1.18.1-1ubuntu0.22.04.3 |
| Ubuntu Pro 16.04 LTS | c-ares | 1.10.0-3ubuntu0.2+esm3 |
| Ubuntu Pro 18.04 LTS | c-ares | 1.14.0-1ubuntu0.2+esm2 |
| Wolfi | c-ares | 1.27.0-r0 |
| openSUSE Leap 15.5 | c-ares | 1.19.1-150000.3.26.1 |
| openSUSE Leap Micro 5.3 | c-ares | 1.19.1-150000.3.26.1 |
| openSUSE Leap Micro 5.4 | c-ares | 1.19.1-150000.3.26.1 |
| openSUSE Tumbleweed | c-ares | 1.27.0-1.1 |