[Debian]: CVE: CVE-2022-4904: c-ares arbitrary length stack overflow

[Yue Tao]

CVE-2022-4904: https://nvd.nist.gov/vuln/detail/CVE-2022-4904

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Score:
cve_id status cvss3Score
CVE-2022-490 fixed 8.6

References:

['libc-ares2_1.17.1-1+deb11u1_amd64.deb===>libc-ares2_1.17.1-1+deb11u2_amd64.deb']

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/882802
Committed: https://opendev.org/starlingx/tools/commit/f7cf153f496684dd90ff31b3db265607a739b083
Submitter: "Zuul (22348)"
Branch: master

commit f7cf153f496684dd90ff31b3db265607a739b083
Author: Zhixiong Chi <email address hidden>
Date: Mon May 8 13:58:40 2023 +0800

    libc-ares2: fix CVE-2022-4904

    Upgrade libc-ares2 to 1.17.1-1+deb11u2

    Refer to:
    https://security-tracker.debian.org/tracker/CVE-2022-4904

    TestPlan:
    PASS: downloader
    PASS: build-pkgs --clean
    PASS: build-image
    PASS: Jenkins Installation.
    PASS: dpkg -l |grep libc-ares2
    ii libc-ares2:amd64 1.17.1-1+deb11u2

    Closes-Bug: 2018638

    Signed-off-by: Zhixiong Chi <email address hidden>
    Change-Id: I97d17710cd297ca57fdf50af280089c32f8e731a