AutoTools does not set CARES_RANDOM_FILE during cross compilation
CVE-2023-31124

3.7LOW

Key Information:

Vendor

C-ares

Status
C-ares
Vendor
CVE Published:
25 May 2023

What is CVE-2023-31124?

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.

Affected Version(s)

c-ares < 1.19.1

References

https://github.com/c-ares/c-ares/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1
x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-ann...

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.