CVE-2020-22217 - Vulnerability Details - OpenCVE

Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
C-ares	C-ares
Debian	Debian Linux
Redhat	Enterprise Linux Rhel Eus

Configuration 1 [-]

OR	cpe:2.3:a:c-ares:c-ares:1.16.1:::::::*
	cpe:2.3:a:c-ares:c-ares:1.17.0:::::::*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
c-ares-0:1.13.0-9.el8_9.1	cpe:/o:redhat:enterprise_linux:8	RHSA-2023:7207	2023-11-14T00:00:00Z
Red Hat Enterprise Linux 8.6 Extended Update Support
c-ares-0:1.13.0-6.el8_6.3	cpe:/o:redhat:rhel_eus:8.6	RHSA-2024:0419	2024-01-25T00:00:00Z
Red Hat Enterprise Linux 8.8 Extended Update Support
c-ares-0:1.13.0-6.el8_8.4	cpe:/o:redhat:rhel_eus:8.8	RHSA-2024:0578	2024-01-30T00:00:00Z

References

Link	Providers
https://github.com/c-ares/c-ares/issues/333
https://github.com/c-ares/c-ares/pull/332
https://lists.debian.org/debian-lts-announce/2023/09/msg00014.html
https://nvd.nist.gov/vuln/detail/CVE-2020-22217
https://www.cve.org/CVERecord?id=CVE-2020-22217

History

Thu, 03 Oct 2024 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-08-22T00:00:00

Updated: 2024-10-03T19:59:30.808Z

Reserved: 2020-08-13T00:00:00

Link: CVE-2020-22217

Vulnrichment

Updated: 2024-08-04T14:51:10.438Z

NVD

Status : Modified

Published: 2023-08-22T19:16:19.050

Modified: 2024-11-21T05:13:11.640

Link: CVE-2020-22217

Redhat

Severity : Moderate

Publid Date: 2023-08-22T00:00:00Z

Links: CVE-2020-22217 - Bugzilla

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:c-ares:c-ares:1.16.1:*:*:*:*:*:*:*", "matchCriteriaId": "F414AE45-51A4-439A-9522-74D765564707", "vulnerable": true}, {"criteria": "cpe:2.3:a:c-ares:c-ares:1.17.0:*:*:*:*:*:*:*", "matchCriteriaId": "80C8C96E-B5F9-41C8-AE10-AF1D7AC3CFEF", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de b\u00fafer en c-ares antes de 1_16_1 a 1_17_0 mediante la funci\u00f3n ares_parse_soa_reply en ares_parse_soa_reply.c."}], "id": "CVE-2020-22217", "lastModified": "2024-11-21T05:13:11.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-22T19:16:19.050", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Patch"], "url": "https://github.com/c-ares/c-ares/issues/333"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00014.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch"], "url": "https://github.com/c-ares/c-ares/issues/333"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00014.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:7207", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "c-ares-0:1.13.0-9.el8_9.1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:0419", "cpe": "cpe:/o:redhat:rhel_eus:8.6", "package": "c-ares-0:1.13.0-6.el8_6.3", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2024-01-25T00:00:00Z"}, {"advisory": "RHSA-2024:0578", "cpe": "cpe:/o:redhat:rhel_eus:8.8", "package": "c-ares-0:1.13.0-6.el8_8.4", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-01-30T00:00:00Z"}], "bugzilla": {"description": "c-ares: Heap buffer over read in ares_parse_soa_reply", "id": "2235527", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235527"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-126", "details": ["Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.", "A heap buffer over-read flaw was found in c-ares via the ares_parse_soa_reply function in ares_parse_soa_reply.c."], "name": "CVE-2020-22217", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-24/ee-supported-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "c-ares", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "c-ares", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs:16/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs:18/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs:20/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "c-ares", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "nodejs:18/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "nodejs:20/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "package_name": "rh-nodejs14-nodejs", "product_name": "Red Hat Software Collections"}], "public_date": "2023-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-22217\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-22217\nhttps://github.com/c-ares/c-ares/issues/333\nhttps://github.com/c-ares/c-ares/pull/332"], "statement": "The attack vector for this flaw initiates from a malicious server (a SOA reply to a client query) which requires a attacker set up a server a make it to be queried by a victim through cache poisoning or MITM, raising the Attack Complexity to High. \nThis being a out of bounds reads does not bring a risk of memory corruption, which makes it of none impact to Integrity. Also the read limitis 2 bytes (16bit, unsigned short int) from the DNS_QUERY_TYPE MACRO[1] return and the read value would be ignored and not propagated anywhere since the subsequent check would also fail making the confidentiality impact as none.\n[1] https://github.com/c-ares/c-ares/blob/4d4fb34075c90d8f2f9ff81890152ab60f65e48e/include/ares_dns.h#L95\n[2] https://github.com/c-ares/c-ares/issues/333", "threat_severity": "Moderate", "upstream_fix": "c-ares 1.17.0"}