Stack Overflow Vulnerability in c-ares Package from Vendor Red Hat
CVE-2022-4904

8.6HIGH

Key Information:

Vendor

C-ares Project

Status
C-ares
Vendor
CVE Published:
6 March 2023

What is CVE-2022-4904?

A vulnerability has been identified in the c-ares package due to the absence of input string validation in the ares_set_sortlist function. This flaw opens the door to a possible stack overflow situation, which could lead to denial of service attacks. Further implications may include risks to the confidentiality and integrity of the system. It is crucial for users of affected versions to apply security patches and enhancements to mitigate potential risks associated with this vulnerability.

Affected Version(s)

c-ares unknown

References

https://bugzilla.redhat.com/show_bug.cgi?id=2168631
https://github.com/c-ares/c-ares/issues/496
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.