[Debian] High CVE: CVE-2023-31130/CVE-2023-32067: c-ares: multiple CVEs

[Yue Tao]

CVE-2023-31130: https://nvd.nist.gov/vuln/detail/CVE-2023-31130

c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.

CVE-2023-32067: https://nvd.nist.gov/vuln/detail/CVE-2023-32067

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

Base Score: High

https://www.tenable.com/plugins/nessus/176888

https://www.debian.org/security/2023/dsa-5419

['libc-ares2_1.17.1-1+deb11u2_amd64.deb===>libc-ares2_1.17.1-1+deb11u3_amd64.deb']

[Ghada Khalil (gkhalil)]

Fixed by: https://review.opendev.org/c/starlingx/tools/+/888019 which merged on July 11