CVE-2023-31147: Insufficient randomness in generation of DNS query IDs in c-ares
Vulnerability summary
CVE-2023-31147 is a medium (CVSS 6.5) Use of Insufficiently Random Values vulnerability in c-ares_project c-ares. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 59.6% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 16 · Related 10Timeline
- 25-05-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
0.90%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.90% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
C-ares1 product
- c-ares< 1.19.1
C-ares_project1 product
- c-ares< 1.19.1
Chainguard1 product
- c-ares< 1.19.1-r0
Debian1 product
- c-aresAll versions (No fix recorded) | < 1.19.1-2
Fedoraproject1 product
- fedoraEOL37 | 38
Wolfi1 product
- c-ares< 1.19.1-r0
6 vendors · 6 products
References
8 links- github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2X Refsource CONFIRMAdvisoryThird Party Advisory
