CVE-2022-4904

CVSS 8.6 HIGHEPSS 1.2%CWE-20

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.6EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

06 mar 2023Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Productos afectados

n/a · c-ares

Referencias

https://bugzilla.redhat.com/show_bug.cgi?id=2168631 https://github.com/c-ares/c-ares/issues/496 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33LDNS6RPOPP36Z4MPWXALUQZXJCWJS2/https://security.gentoo.org/glsa/202401-02