search

vipinsun / minifabric

Do fabric network the right and easy way.
Apache License 2.0
0 stars 0 forks source link

CVE-2022-4904 (High) detected in c-aresc-ares-1.15.0 #114

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2022-4904 - High Severity Vulnerability

Vulnerable Library - c-aresc-ares-1.15.0

A C library for asynchronous DNS requests.

Library home page: https://c-ares.haxx.se/?wsslib=c-ares

Found in HEAD commit: 655167764fcdebd1047d2f63249a7596884c4b03

Found in base branch: main

Vulnerable Source Files (1)

/chaincode/simple/node/node_modules/fabric-shim/node_modules/grpc/deps/grpc/third_party/cares/cares/ares_init.c

Vulnerability Details

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Publish Date: 2023-03-06

URL: CVE-2022-4904

CVSS 3 Score Details (8.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-02-13

Fix Resolution: cares-1_19_0

Step up your Open Source Security Game with Mend here