CVE-2022-4904 (High) detected in c-aresc-ares-1.15.0

[mend-bolt-for-github[bot]]

CVE-2022-4904 - High Severity Vulnerability

Vulnerable Library - c-aresc-ares-1.15.0

A C library for asynchronous DNS requests.

Library home page: https://c-ares.haxx.se/?wsslib=c-ares

Found in HEAD commit: d388e16464e00b9ce84df0d247029f534a429b90

Found in base branch: main

Vulnerable Source Files (1)

/utility-emissions-channel/typescript_app/node_modules/grpc/deps/grpc/third_party/cares/cares/ares_init.c

Vulnerability Details

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Publish Date: 2023-03-06

URL: CVE-2022-4904

CVSS 3 Score Details (8.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-02-13

Fix Resolution: cares-1_19_0

---

Step up your Open Source Security Game with Mend here