CVE-2023-32067

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.
Configurations

Configuration 1 (hide)

cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

History

31 Oct 2023, 16:06

Type Values Removed Values Added
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
First Time Debian debian Linux
Debian
References (MISC) https://security.gentoo.org/glsa/202310-09 - (MISC) https://security.gentoo.org/glsa/202310-09 - Third Party Advisory
References (MISC) https://www.debian.org/security/2023/dsa-5419 - (MISC) https://www.debian.org/security/2023/dsa-5419 - Third Party Advisory
References (MISC) https://lists.debian.org/debian-lts-announce/2023/06/msg00034.html - (MISC) https://lists.debian.org/debian-lts-announce/2023/06/msg00034.html - Mailing List
CWE CWE-400 NVD-CWE-noinfo

08 Oct 2023, 09:15

Type Values Removed Values Added
References
  • (MISC) https://security.gentoo.org/glsa/202310-09 -

26 Jun 2023, 22:15

Type Values Removed Values Added
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/06/msg00034.html -

07 Jun 2023, 10:15

Type Values Removed Values Added
References
  • (MISC) https://www.debian.org/security/2023/dsa-5419 -

01 Jun 2023, 13:09

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:*
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/ - Mailing List, Third Party Advisory
References (MISC) https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc - (MISC) https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc - Third Party Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/ - Mailing List, Third Party Advisory
References (MISC) https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1 - (MISC) https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1 - Release Notes
First Time C-ares Project c-ares
C-ares Project
Fedoraproject
Fedoraproject fedora
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
CWE CWE-400

28 May 2023, 06:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/ -

26 May 2023, 05:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/ -

25 May 2023, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-05-25 23:15

Updated : 2023-12-10 15:01


NVD link : CVE-2023-32067

Mitre link : CVE-2023-32067

CVE.ORG link : CVE-2023-32067


JSON object : View

Products Affected

c-ares_project

  • c-ares

debian

  • debian_linux

fedoraproject

  • fedora
CWE
NVD-CWE-noinfo CWE-400

Uncontrolled Resource Consumption