Read the docs
TI-2023-14857 Aliases CVE-2023-31147

Insufficient randomness in generation of DNS query IDs in c-ares

Priority LOW 31CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 7 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00905 60th percentileScored 2026-11-07
Fix Partial c-ares (c-ares): 1.19.1Red Hat: 8 advisoriesRed Hat: 7 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
c-aresc-aresbefore 1.19.11.19.1Patch availableCNA
  • c-ares Vendorc-ares Affected before 1.19.1 Fixed in 1.19.1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:*before 1.19.1VulnerableC-ares Project
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
  • cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:* Versions before 1.19.1 Vulnerable ·C-ares Project
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA c-ares (c-ares) Fixed in 1.19.1

Red Hat 8 advisories

  • RHSA-2023:6635 Released 2023-11-07 · Red Hat rating Moderate
    c-ares security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) c-ares-devel-1.19.1-1.el9
    • Red Hat Enterprise Linux BaseOS (v. 9) c-ares-1.19.1-1.el9
  • RHSA-2023:4035 Released 2023-07-12 · Red Hat rating Important
    nodejs:18 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.14.2-3.module+el8.8.0+19021+4b8b11cc.aarch64::nodejs:18, nodejs-1:18.14.2-3.module+el8.8.0+19021+4b8b11cc.ppc64le::nodejs:18, nodejs-1:18.14.2-3.module+el8.8.0+19021+4b8b11cc.s390x::nodejs:18 +20
  • RHSA-2023:4034 Released 2023-07-12 · Red Hat rating Important
    nodejs:16 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.19.1-2.module+el8.8.0+19038+6f60344f.aarch64::nodejs:16, nodejs-1:16.19.1-2.module+el8.8.0+19038+6f60344f.ppc64le::nodejs:16, nodejs-1:16.19.1-2.module+el8.8.0+19038+6f60344f.s390x::nodejs:16 +19
Show 5 more Red Hat advisories
  • RHSA-2023:4033 Released 2023-07-12 · Red Hat rating Important
    nodejs:16 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:16.19.1-2.module+el8.6.0+19139+7f27a8ff.aarch64::nodejs:16, nodejs-1:16.19.1-2.module+el8.6.0+19139+7f27a8ff.ppc64le::nodejs:16, nodejs-1:16.19.1-2.module+el8.6.0+19139+7f27a8ff.s390x::nodejs:16 +19
  • RHSA-2023:4039 Released 2023-07-12 · Red Hat rating Important
    rh-nodejs14-nodejs security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.21.3-4.el7, rh-nodejs14-nodejs-devel-14.21.3-4.el7, rh-nodejs14-nodejs-docs-14.21.3-4.el7 +2
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.21.3-4.el7, rh-nodejs14-nodejs-devel-14.21.3-4.el7, rh-nodejs14-nodejs-docs-14.21.3-4.el7 +2
  • RHSA-2023:4036 Released 2023-07-12 · Red Hat rating Important
    nodejs security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) nodejs-1:16.18.1-4.el9_0, nodejs-docs-1:16.18.1-4.el9_0, nodejs-full-i18n-1:16.18.1-4.el9_0 +2
  • RHSA-2023:3586 Released 2023-06-14 · Red Hat rating Important
    nodejs security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.19.1-2.el9_2, nodejs-docs-1:16.19.1-2.el9_2, nodejs-full-i18n-1:16.19.1-2.el9_2 +2
  • RHSA-2023:3577 Released 2023-06-14 · Red Hat rating Important
    nodejs:18 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.14.2-3.module+el9.2.0.z+18964+42696395.aarch64::nodejs:18, nodejs-1:18.14.2-3.module+el9.2.0.z+18964+42696395.ppc64le::nodejs:18, nodejs-1:18.14.2-3.module+el9.2.0.z+18964+42696395.s390x::nodejs:18 +20

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:4034, RHSA-2023:4035
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:3577, RHSA-2023:3586, RHSA-2023:6635
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:4033
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:4036
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:6635
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:4039
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:4039

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-31147

References

Advisory 4

Other 1

  • TI-2026-48538 c-ares: Memory-amplification denial of service via unvalidated DNS header record counts CVSS 3.1MEDIUM 5.3
  • TI-2020-14305 Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function… CVSS 3.1MEDIUM 5.9
  • TI-2016-04481 Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0… CVSS 3.1CRITICAL 9.8
  • TI-2023-15371 0-byte UDP payload DoS in c-ares CVSS 3.1HIGH 7.5
  • TI-2026-26011 Double free in c-ares CVSS 3.1HIGH 7.5
  • TI-2026-48536 c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences