CVE-2023-31130

Name	CVE-2023-31130
Description	c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3471-1, DSA-5419-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
c-ares (PTS)	buster	1.14.0-1+deb10u1	vulnerable
	buster (security)	1.14.0-1+deb10u4	fixed
	bullseye (security), bullseye	1.17.1-1+deb11u3	fixed
	bookworm	1.18.1-3	fixed
	sid, trixie	1.28.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
c-ares	source	experimental	1.19.1-1
c-ares	source	buster	1.14.0-1+deb10u3	DLA-3471-1
c-ares	source	bullseye	1.17.1-1+deb11u3	DSA-5419-1
c-ares	source	(unstable)	1.18.1-3

Notes

https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v
https://github.com/c-ares/c-ares/commit/f22cc01039b6473b736d3bf438f56a2654cdf2b2 (cares-1_19_1)