Read the docs
TI-2017-14601 Aliases CVE-2017-1000381GHSA-vjr3-54h8-whpv

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR…

Priority LOW 39CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 6 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.

Why it matters now

EPSS 0.03337 88th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 6 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:c-ares:c-ares:1.8.0:*:*:*:*:*:*:*1.8.0Vulnerablec-ares
cpe:2.3:a:c-ares:c-ares:1.9.0:*:*:*:*:*:*:*1.9.0Vulnerablec-ares
cpe:2.3:a:c-ares:c-ares:1.9.1:*:*:*:*:*:*:*1.9.1Vulnerablec-ares
cpe:2.3:a:c-ares:c-ares:1.10.0:*:*:*:*:*:*:*1.10.0Vulnerablec-ares
cpe:2.3:a:c-ares:c-ares:1.12.0:*:*:*:*:*:*:*1.12.0Vulnerablec-ares
cpe:2.3:a:c-ares_project:c-ares:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableC-ares Project
cpe:2.3:a:c-ares_project:c-ares:1.11.0:rc1:*:*:*:*:*:*1.11.0 rc1VulnerableC-ares Project
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*4.0.0 – 4.1.2VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*4.2.0 to before 4.8.4VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*5.0.0 – 5.12.0; 6.0.0 – 6.8.1VulnerableNodeJS
  • cpe:2.3:a:c-ares:c-ares:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·c-ares
  • cpe:2.3:a:c-ares:c-ares:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·c-ares
  • cpe:2.3:a:c-ares:c-ares:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·c-ares
  • cpe:2.3:a:c-ares:c-ares:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·c-ares
  • cpe:2.3:a:c-ares:c-ares:1.12.0:*:*:*:*:*:*:* Versions 1.12.0 Vulnerable ·c-ares
  • cpe:2.3:a:c-ares_project:c-ares:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·C-ares Project
  • cpe:2.3:a:c-ares_project:c-ares:1.11.0:rc1:*:*:*:*:*:* Versions 1.11.0 rc1 Vulnerable ·C-ares Project
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 4.0.0 – 4.1.2 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 4.2.0 to before 4.8.4 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 5.0.0 – 5.12.0; 6.0.0 – 6.8.1 Vulnerable ·NodeJS
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*6.9.0 to before 6.11.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*7.0.0 to before 7.10.1; 8.0.0 to before 8.1.4VulnerableNodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 6.9.0 to before 6.11.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 7.0.0 to before 7.10.1; 8.0.0 to before 8.1.4 Vulnerable ·NodeJS

Remediation

Red Hat 1 advisory

  • RHSA-2017:2908 Released 2017-10-18 · Red Hat rating Moderate
    rh-nodejs6-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-nodejs6-nodejs-6.11.3-2.el6, rh-nodejs6-nodejs-devel-6.11.3-2.el6, rh-nodejs6-nodejs-docs-6.11.3-2.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs6-nodejs-6.11.3-2.el7, rh-nodejs6-nodejs-devel-6.11.3-2.el7, rh-nodejs6-nodejs-docs-6.11.3-2.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-nodejs6-nodejs-6.11.3-2.el6, rh-nodejs6-nodejs-devel-6.11.3-2.el6, rh-nodejs6-nodejs-docs-6.11.3-2.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-nodejs6-nodejs-6.11.3-2.el7, rh-nodejs6-nodejs-devel-6.11.3-2.el7, rh-nodejs6-nodejs-docs-6.11.3-2.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-nodejs6-nodejs-6.11.3-2.el6, rh-nodejs6-nodejs-devel-6.11.3-2.el6, rh-nodejs6-nodejs-docs-6.11.3-2.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs6-nodejs-6.11.3-2.el7, rh-nodejs6-nodejs-devel-6.11.3-2.el7, rh-nodejs6-nodejs-docs-6.11.3-2.el7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational ToolsAffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 2AffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 3AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix yet
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2017:2908
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2017:2908
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)Fixed RHSA-2017:2908
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)Fixed RHSA-2017:2908
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2017:2908
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2017:2908
Not affected: 1 product
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1000381
  2. 2026-10-03 Alias added: GHSA-vjr3-54h8-whpv

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences