CVE-2024-25629
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-25629
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25629.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-25629
- Aliases
-
- GHSA-mg26-v6qh-x48q
- Related
- Published
- 2024-02-23T15:15:09Z
- Modified
- 2024-08-01T04:59:06.194912Z
- Summary
- [none]
- Details
-
c-ares is a C library for asynchronous DNS requests.
ares__read_line()is used to parse local configuration files such as/etc/resolv.conf,/etc/nsswitch.conf, theHOSTALIASESfile, and if using a c-ares version prior to 1.27.0, the/etc/hostsfile. If any of these configuration files has an embeddedNULLcharacter as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist. - References
-
- https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q
- https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P76QYINQNPEHUTEEDOUYIRZ2X6UVZ5K/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSCMTSPDIE2UHU34TIXQQHZ6JTE3Y3VF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX37LFPFQ3T6FFMMFYQTEGIQXXN7F27U/
- https://security.alpinelinux.org/vuln/CVE-2024-25629
Affected packages
Alpine:v3.16 / c-ares
Package
- Name
- c-ares
- Purl
- pkg:apk/alpine/c-ares?arch=source
Alpine:v3.17 / c-ares
Package
- Name
- c-ares
- Purl
- pkg:apk/alpine/c-ares?arch=source
Alpine:v3.18 / c-ares
Package
- Name
- c-ares
- Purl
- pkg:apk/alpine/c-ares?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.19.1-r1
Affected versions
1.*
1.6.0-r0
1.6.0-r1
1.7.0-r0
1.7.0-r1
1.7.3-r0
1.7.4-r0
1.7.4-r1
1.7.4-r2
1.7.5-r0
1.8.0-r0
1.9.0-r0
1.9.1-r0
1.10.0-r0
1.10.0-r1
1.11.0-r0
1.12.0-r0
1.13.0-r0
1.13.0-r1
1.14.0-r0
1.15.0-r0
1.15.0-r1
1.16.0-r0
1.16.1-r0
1.17.1-r0
1.17.1-r1
1.17.2-r0
1.18.1-r0
1.18.1-r1
1.19.0-r0
1.19.0-r1
1.19.0-r2
1.19.0-r3
1.19.1-r0
Alpine:v3.19 / c-ares
Package
- Name
- c-ares
- Purl
- pkg:apk/alpine/c-ares?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.27.0-r0
Affected versions
1.*
1.6.0-r0
1.6.0-r1
1.7.0-r0
1.7.0-r1
1.7.3-r0
1.7.4-r0
1.7.4-r1
1.7.4-r2
1.7.5-r0
1.8.0-r0
1.9.0-r0
1.9.1-r0
1.10.0-r0
1.10.0-r1
1.11.0-r0
1.12.0-r0
1.13.0-r0
1.13.0-r1
1.14.0-r0
1.15.0-r0
1.15.0-r1
1.16.0-r0
1.16.1-r0
1.17.1-r0
1.17.1-r1
1.17.2-r0
1.18.1-r0
1.18.1-r1
1.19.0-r0
1.19.0-r1
1.19.0-r2
1.19.0-r3
1.19.0-r4
1.19.1-r0
1.19.1-r1
1.20.1-r0
1.21.0-r0
1.22.0-r0
1.22.1-r0
1.24.0-r0
1.24.0-r1
Alpine:v3.20 / c-ares
Package
- Name
- c-ares
- Purl
- pkg:apk/alpine/c-ares?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.27.0-r0
Affected versions
1.*
1.6.0-r0
1.6.0-r1
1.7.0-r0
1.7.0-r1
1.7.3-r0
1.7.4-r0
1.7.4-r1
1.7.4-r2
1.7.5-r0
1.8.0-r0
1.9.0-r0
1.9.1-r0
1.10.0-r0
1.10.0-r1
1.11.0-r0
1.12.0-r0
1.13.0-r0
1.13.0-r1
1.14.0-r0
1.15.0-r0
1.15.0-r1
1.16.0-r0
1.16.1-r0
1.17.1-r0
1.17.1-r1
1.17.2-r0
1.18.1-r0
1.18.1-r1
1.19.0-r0
1.19.0-r1
1.19.0-r2
1.19.0-r3
1.19.0-r4
1.19.1-r0
1.19.1-r1
1.20.1-r0
1.21.0-r0
1.22.0-r0
1.22.1-r0
1.23.0-r0
1.24.0-r0
1.25.0-r0
1.25.0-r1
1.26.0-r0
Git / github.com/c-ares/c-ares
Affected ranges
- Type
- GIT
- Repo
- https://github.com/c-ares/c-ares
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
Other
c-ares-1_17_0
c-ares-1_2_0
cares-1_10_0
cares-1_11_0
cares-1_11_0-rc1
cares-1_12_0
cares-1_13_0
cares-1_14_0
cares-1_15_0
cares-1_16_0
cares-1_16_1
cares-1_17_1
cares-1_17_2
cares-1_18_0
cares-1_18_1
cares-1_19_0
cares-1_19_1
cares-1_1_0
cares-1_20_0
cares-1_20_1
cares-1_21_0
cares-1_22_0
cares-1_22_1
cares-1_23_0
cares-1_24_0
cares-1_25_0
cares-1_26_0
cares-1_2_1
cares-1_3_1
cares-1_3_2
cares-1_4_0
cares-1_5_0
cares-1_5_1
cares-1_5_2
cares-1_5_3
cares-1_6_0
cares-1_7_0
cares-1_7_1
cares-1_7_2
cares-1_7_3
cares-1_7_4
cares-1_7_5
cares-1_8_0
cares-1_9_0
cares-1_9_1
curl-7_10_8
curl-7_11_0
curl-7_11_1
curl-7_12_0
curl-7_12_1
curl-7_12_2
curl-7_13_0
curl-7_13_1
curl-7_13_2
curl-7_14_0
curl-7_14_1
curl-7_15_0
curl-7_15_1
curl-7_15_3
curl-7_15_4
curl-7_15_5
curl-7_15_6-prepipeline
curl-7_16_0
curl-7_16_1
curl-7_16_2
curl-7_16_3
curl-7_16_4
curl-7_17_0
curl-7_17_1
curl-7_18_0
curl-7_18_1
curl-7_18_2
curl-7_19_0
curl-7_19_2
curl-7_19_3
curl-7_19_4
curl-7_19_5
curl-7_19_6
curl-7_19_7
curl-7_20_0