Read the docs
TI-2022-04495 Aliases CVE-2022-4904GHSA-v7h6-g695-5j7q

Improper input validation in c-ares

Priority MEDIUM 46CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Partial Red Hat: 13 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01232 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 14 advisoriesRed Hat: 13 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—c-aresunknown—No fix listedCNA
  • c-ares Vendor— Affected unknown Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:*before 1.19.0VulnerableC-ares Project
cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
  • cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:* Versions before 1.19.0 Vulnerable ·C-ares Project
  • cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

Red Hat 14 advisories

  • RHSA-2023:7543 Released 2023-11-28 · Red Hat rating Moderate
    c-ares security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) c-ares-1.13.0-6.el8_8.3, c-ares-devel-1.13.0-6.el8_8.3
  • RHSA-2023:7368 Released 2023-11-21 · Red Hat rating Moderate
    c-ares security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) c-ares-devel-1.17.1-5.el9_2.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) c-ares-1.17.1-5.el9_2.2
  • RHSA-2023:7116 Released 2023-11-14 · Red Hat rating Moderate
    c-ares security update
    • Red Hat Enterprise Linux BaseOS (v. 8) c-ares-1.13.0-8.el8, c-ares-devel-1.13.0-8.el8
Show 11 more Red Hat advisories
  • RHSA-2023:6635 Released 2023-11-07 · Red Hat rating Moderate
    c-ares security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) c-ares-devel-1.19.1-1.el9
    • Red Hat Enterprise Linux BaseOS (v. 9) c-ares-1.19.1-1.el9
  • RHSA-2023:6291 Released 2023-11-02 · Red Hat rating Moderate
    c-ares security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) c-ares-devel-1.17.1-5.el9_0.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) c-ares-1.17.1-5.el9_0.2
  • RHSA-2023:5533 Released 2023-10-09 · Red Hat rating Important
    nodejs security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) nodejs-1:16.20.2-1.el9_0, nodejs-docs-1:16.20.2-1.el9_0, nodejs-full-i18n-1:16.20.2-1.el9_0 +2
  • RHSA-2023:4035 Released 2023-07-12 · Red Hat rating Important
    nodejs:18 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.14.2-3.module+el8.8.0+19021+4b8b11cc.aarch64::nodejs:18, nodejs-1:18.14.2-3.module+el8.8.0+19021+4b8b11cc.ppc64le::nodejs:18, nodejs-1:18.14.2-3.module+el8.8.0+19021+4b8b11cc.s390x::nodejs:18 +20
  • RHSA-2023:2655 Released 2023-05-09 · Red Hat rating Moderate
    nodejs and nodejs-nodemon security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.19.1-1.el9_2, nodejs-docs-1:16.19.1-1.el9_2, nodejs-full-i18n-1:16.19.1-1.el9_2 +3
  • RHSA-2023:2654 Released 2023-05-09 · Red Hat rating Moderate
    nodejs:18 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18, nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18, nodejs-1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18 +20
  • RHSA-2023:1744 Released 2023-04-12 · Red Hat rating Important
    rh-nodejs14-nodejs security, bug fix, and enhancement update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-3.6-2.el7, rh-nodejs14-nodejs-14.21.3-2.el7, rh-nodejs14-nodejs-devel-14.21.3-2.el7 +5
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-3.6-2.el7, rh-nodejs14-nodejs-14.21.3-2.el7, rh-nodejs14-nodejs-devel-14.21.3-2.el7 +5
  • RHSA-2023:1742 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x::nodejs:14 +19
  • RHSA-2023:1743 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x::nodejs:14 +19
  • RHSA-2023:1582 Released 2023-04-04 · Red Hat rating Moderate
    nodejs:16 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.aarch64::nodejs:16, nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.ppc64le::nodejs:16, nodejs-1:16.19.1-1.module+el8.7.0+18373+704f5cef.s390x::nodejs:16 +19
  • RHSA-2023:1533 Released 2023-03-30 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x::nodejs:14 +19

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:1582, RHSA-2023:1743, RHSA-2023:4035
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:2654, RHSA-2023:2655, RHSA-2023:6635
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:1533
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:1742
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:5533, RHSA-2023:6291
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2023:7368
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:7116
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:6635
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2023:7543
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2023:6291
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2023:7368
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:1744
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:1744
Not affected: 1 product
  • Red Hat Enterprise Linux AppStream (v. 9)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4904
  2. 2026-10-03 Alias added: GHSA-v7h6-g695-5j7q

References

Exploit 1

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences