CVE-2023-32067

Name	CVE-2023-32067
Description	c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3471-1, DSA-5419-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
c-ares (PTS)	buster	1.14.0-1+deb10u1	vulnerable
	buster (security)	1.14.0-1+deb10u4	fixed
	bullseye (security), bullseye	1.17.1-1+deb11u3	fixed
	bookworm	1.18.1-3	fixed
	sid, trixie	1.27.0-1.2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
c-ares	source	experimental	1.19.1-1
c-ares	source	buster	1.14.0-1+deb10u3	DLA-3471-1
c-ares	source	bullseye	1.17.1-1+deb11u3	DSA-5419-1
c-ares	source	(unstable)	1.18.1-3

Notes

https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc
https://github.com/c-ares/c-ares/commit/b9b8413cfdb70a3f99e1573333b23052d57ec1ae (cares-1_19_1)