Buffer overflow in C-Ares
CVE-2020-14354
A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
Vulnerability class: Buffer Overflow
EPSS: 0.005 (41.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- C-ares — versions 1.16.0
- Fedoraproject Fedora — versions 33
- N/a C-ares — versions c-ares 1.16.1
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_FEDORA, vendor-advisory)
- secalert@redhat.com (Exploit, Patch, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- secalert@redhat.com (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
- secalert@redhat.com (x_refsource_MISC, Release Notes, Vendor Advisory)
- secalert@redhat.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-14354?
- CVE-2020-14354 is a low-severity vulnerability in C-Ares, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 3.3/10. Published 2021-05-13.
- How severe is CVE-2020-14354?
- Low severity. CVSS v3 base score is 3.3 out of 10.