CVE-2020-22217 (Medium) detected in c-aresc-ares-1.15.0

[mend-bolt-for-github[bot]]

CVE-2020-22217 - Medium Severity Vulnerability

Vulnerable Library - c-aresc-ares-1.15.0

A C library for asynchronous DNS requests.

Library home page: https://c-ares.haxx.se/?wsslib=c-ares

Found in HEAD commit: d388e16464e00b9ce84df0d247029f534a429b90

Found in base branch: main

Vulnerable Source Files (1)

/utility-emissions-channel/typescript_app/node_modules/grpc/deps/grpc/third_party/cares/cares/ares_parse_soa_reply.c

Vulnerability Details

Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.

Publish Date: 2023-08-22

URL: CVE-2020-22217

CVSS 3 Score Details (5.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-08-22

Fix Resolution: NO_fIX

---

Step up your Open Source Security Game with Mend here