CVE-2023-31124 AutoTools does not set CARES_RANDOM_FILE during cross compilation

What is CVE-2023-31124?

CVE-2023-31124 is a low-severity vulnerability in Fedoraproject Fedora, published on 25 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.

Weakness: CWE-330

Which versions are affected by CVE-2023-31124?

It affects 2 products.

Products include C-Ares Project C-Ares, Fedoraproject Fedora.

How do I fix CVE-2023-31124?

Upgrade to a fixed version.

Is CVE-2023-31124 being exploited?

There is no known exploitation of CVE-2023-31124 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2022-4904 Memory corruption in c-ares High 8.6
• CVE-2023-32067 0-byte UDP payload DoS in c-ares High 7.5
• CVE-2020-8277 Uncontrolled Resource Consumption in node High 7.5
• CVE-2023-31147 Insufficient randomness in generation of DNS query IDs in c-ares Medium 5.9
• CVE-2021-3672 Other in c-ares Medium 5.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-31124, ECHO-8d69-487f-cac3, GHSA-54xr-f67r-4pc4.