🛡️ OESA-2023-1339 — c-ares (CVE-2023-31147)

🟡 CVSS 5.0 — Medium ✅ No Known Exploit OSV
5.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

c-ares security update

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple

Security Fix(es):

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.(CVE-2023-31147)

Affected software

OESA-2023-1339 is recorded against 1 package.

  • c-ares (fixed in 1.18.1-6.oe2203)

Timeline and source

Published on 10 June 2023 and last revised on 3 September 2025. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

www.openeuler.org (Advisory)
nvd.nist.gov (Advisory)

Details

Severity MEDIUM
CVSS Score 5.0
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2023-06-10
Updated 2026-08-12
Modified 2025-09-03
Fix URL N/A

Affected Packages

Software From version Fixed in
c-ares — 1.18.1-6.oe2203

Similar Threats

Vulnerability Monitoring

Track new vulnerabilities in c-ares

OESA-2023-1339 is rated CVSS 5.0 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesopenEuleropenEuler 2023