CVE-2023-31124: C-Ares Project C-Ares

Low severity, CVSS 3.7. EPSS: 0.9% chance of exploitation in the next 30 days.

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.

Affected products

• C-Ares Project C-Ares: before 1.19.1 (fixed in 1.19.1)
• Fedoraproject Fedora: version 37 only; version 38 only

Published 2023-05-25. Last modified 2026-06-17.