DirectorySecurity Advisories
Sign In
Security Advisories

CVE-2023-31147

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-31147

CGA ID

CGA-xjrj-j9vj-r4g9

Severity

6.5

Medium

CVSS V3

Description

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.

References

Affected packages


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2024 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard Images