CVE-2022-4904

CVSS 8.6 HIGHEPSS 1.2%CWE-20

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.6EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

06 Mar 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

n/a · c-ares

References

https://bugzilla.redhat.com/show_bug.cgi?id=2168631 https://github.com/c-ares/c-ares/issues/496 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33LDNS6RPOPP36Z4MPWXALUQZXJCWJS2/https://security.gentoo.org/glsa/202401-02