huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-21661: argo-cd: Denial of Service Due to Unsafe Array Modification in Multi-threaded Environment
Component: argo-cd
Severity: Important
CWE: CWE-567 (Unsynchronized Access to Shared Data in a Multithreaded Context)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-18T00:00:00+00:00

A flaw was found in Argo CD that may result in a remote denial of service. The expireOldFailedAttempts function modifies an array while it is being iterated over. This issue may cause an application crash when executed in a multi-threaded environment if two threads interact with the same array simultaneously.


Affected upstream versions: < 2.8.13, >= 2.9.0, < 2.9.9, >= 2.10.0, < 2.10.4
Fixed upstream versions: v2.8.13
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 2a22e19e06aaf6a1e734443043310a66c234e345
CVE-2024-21662: argo-cd: Bypassing Rate Limit and Brute Force Protection Using Cache Overflow
Component: argo-cd
Severity: Moderate
CWE: CWE-307 (Improper Restriction of Excessive Authentication Attempts)
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
Public date: 2024-03-18T00:00:00+00:00

A flaw was found in Argo CD, where the rate limit for login attempts may be bypassed due to an incomplete fix for CVE-2020-8827. The cache-based mechanism is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by sending excessive login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account.


Affected upstream versions: < 2.8.13, >= 2.9.0, < 2.9.9, >= 2.10.0, < 2.10.4
Fixed upstream versions: v2.8.13
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d
CVE-2024-22099: kernel: NULL Pointer dereference  bluetooth allows Overflow Buffers
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-01-25T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel in rfcomm_check_security. This issue may lead to buffer overflows.


Affected upstream versions: v2.6.12-rc2 < v6.8-rc1
Fixed upstream versions: v6.8-rc1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
Upstream fix commit: 6ec00b0737fe
CVE-2024-22189: quic-go: memory exhaustion attack against QUIC's connection ID mechanism
Component: quic-go
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-04T00:00:00+00:00

A flaw was found in quic-go. This issue may allow an attacker to trigger a denial of service by sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame, but the attacker can prevent the receiver from sending out the vast majority of these RETIRE_CONNECTION_ID frames by selectively acknowledging received packets and collapsing the peers congestion window and by manipulating the peer's RTT estimate.


Affected upstream versions: < 0.42.0
Fixed upstream versions: v0.42.0
Upstream repository: https://github.com/quic-go/quic-go
Upstream fix commit: 4a99b816ae3ab03ae5449d15aac45147c85ed47a
CVE-2024-22211: freerdp: Integer Overflow leading to Heap Overflow in freerdp_bitmap_planar_context_reset
Component: freerdp
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L)
Public date: 2024-01-19T00:00:00+00:00

FreeRDP is a collection of remote desktop protocol library and client software that is both free and open source. An integer overflow within freerdp_bitmap_planar_context_reset results in a heap-buffer overflow. This impacts clients built on FreeRDP. However, server implementations and proxies based on FreeRDP are unaffected. A malevolent server could create a RDPGFX_RESET_GRAPHICS_PDU to allocate buffers that are too small, potentially causing subsequent out-of-bounds reads/writes. It's important to note that data extraction over the network is not feasible; these buffers are utilized solely for displaying images.

Statement: This vulnerability in FreeRDP, resulting from an integer overflow in certain versions, poses a low severity risk due to several mitigating factors. Firstly, it primarily affects FreeRDP-based clients, while server implementations and proxies remain unaffected. Additionally, the potential for exploitation is limited as it requires interaction with a malicious server, and data extraction over the network is not feasible; the vulnerability pertains solely to image display buffers.

Affected upstream versions: < 2.11.5, >= 3.0.0, < 3.2.0
Fixed upstream versions: 3.2.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 939e922936e9c3ae8fc204968645e5e7563a2fff
CVE-2024-22365: pam: allowing unprivileged user to block another user namespace
Component: pam
Severity: Moderate
CWE: CWE-277 (Insecure Inherited Permissions)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-01-18T00:00:00+00:00

A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with `pam_namespace` configured will cause the `openat()` in `protect_dir()` to block the attempt, causing a local denial of service.

Statement: Red Hat rates this as Moderate, as this vulnerability needs a non-default configuration in order to be explored by a malicious user. Also, the attack is local and the Denial of Service happens to a single user.

Affected upstream versions: n/a
Fixed upstream versions: v1.6.0
Upstream repository: https://github.com/linux-pam/linux-pam
Upstream fix commit: 031bb5a5d0d950253b68138b498dc93be69a64cb
CVE-2024-2313: bpftrace: unprivileged users can force loading of compromised linux headers
Component: bpftrace
Severity: Low
CWE: CWE-284 (Improper Access Control)
CVSS v3: 2.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2024-03-10T00:00:00+00:00

A flaw was found in BPFtrace. This issue occurs when extracting kernel headers, it tries to load them from a temporary directory. This issue could allow an attacker to force bpftrace to load compromised Linux headers by placing malicious headers in the temporary directory, leading to potential security risks, unauthorized access, or system compromise.

Statement: This flaw is triggered by handling malicious input and the overall impact is considered minimal.

Affected upstream versions: <= v0.20.0
Fixed upstream versions: 0
Upstream repository: https://github.com/bpftrace/bpftrace
Upstream fix commit: 4be4b7191acb8218240e6b7178c30fa8c9b59998
CVE-2024-2314: bcc: unprivileged users can force loading of compromised linux headers
Component: bcc
Severity: Low
CWE: CWE-284 (Improper Access Control)
CVSS v3: 2.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2024-03-10T00:00:00+00:00

A flaw was found in the BCC toolset. This issue occurs when extracting kernel headers, it tries to load them from a temporary directory. This issue could allow an attacker to force bcc to load compromised Linux headers by placing malicious headers in the temporary directory, leading to potential security risks, unauthorized access, or system compromise.

Statement: This flaw is triggered by handling malicious input and the overall impact is considered minimal.

Affected upstream versions: <= v0.29.1
Fixed upstream versions: v0.30.0
Upstream repository: https://github.com/iovisor/bcc
Upstream fix commit: 008ea09e891194c072f2a9305a3c872a241dc342
CVE-2024-23334: aiohttp: follow_symlinks directory traversal vulnerability
Component: aiohttp
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-01-30T00:00:00+00:00

A flaw was found in aiohttp. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if a given file path is within the root directory. This issue can lead to a directory traversal vulnerability, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present.

Statement: This vulnerability has been rated as having a moderate impact. There is a non-default precondition which is required to exploit it: the follow_symlinks setting needs to be enabled.

Affected upstream versions: < 3.9.2
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: 1c335944d6a8b1298baf179b7c0b3069f10c514b
CVE-2024-23337: jq: jq has signed integer overflow in jv.c:jvp_array_write
Component: jq
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2025-05-21T14:34:51.007000+00:00

A flaw was found in jq, a command line JSON processor. An integer overflow can occur when attempting to assign a value using an array index of 2147483647 or when creating an array with 2147483647 elements, the maximum value for a 32-bit signed integer. This issue causes out-of-bounds memory access and results in a denial of service.

Statement: To exploit this flaw, an attacker needs to trick a user into processing a specially crafted JSON input, allowing an attacker to trigger an integer overflow and cause a crash in jq with no other security impact. Due to these reasons, this flaw has been rated with a Moderate severity.

Affected upstream versions: <= 1.7.1
Fixed upstream versions: jq-1.8.0
Upstream repository: https://github.com/jqlang/jq
Upstream fix commit: de21386681c0df0104a99d9d09db23a9b2a78b1e
CVE-2024-2357: libreswan: Missing PreSharedKey for connection can cause crash
Component: libreswan
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-03-11T00:00:00+00:00

A flaw was found in Libreswan. This issue causes Libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret), and the connection cannot find a matching configured secret. When automatically added on startup using the auto= keyword, it can cause repeated crashes, leading to a denial of service.

Statement: Libreswan may restart repeatedly under certain IKEv2 retransmission scenarios when using PreSharedKeys (authby=secret) if the connection cannot find a matching configured secret. If such a connection is added automatically on startup using the auto= keyword, it can lead to repeated crashes, causing a denial of service. The vulnerability arises when IKEv2 fails to find its PreSharedKey for the AUTH payload in the IKE_AUTH Exchange, resulting in assertion failure and daemon crashes. This vulnerability is triggered by local misconfiguration, and there is no known exploitation by external peers.

Affected upstream versions: 4.2 <= 4.12
Fixed upstream versions: 3.0, 5.0
Upstream repository: https://github.com/libreswan/libreswan
Upstream fix commit: cb9e1047d33fde695d63a95854c2bc2470a476c8
CVE-2024-23638: squid: vulnerable to a Denial of Service attack against Cache Manager error responses
Component: squid
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-01-24T00:00:00+00:00

A flaw was found in Squid, resulting in a potential denial of service attack targeting Cache Manager error responses. This issue enables a trusted client to execute a denial of service by manipulating the generation of error pages for Client Manager reports.

Statement: The identified vulnerability in Squid, leading to a Denial of Service attack against Cache Manager error responses, is considered a moderate issue. While it requires a trusted client for exploitation, the potential impact lies in the ability to disrupt normal functioning by manipulating error pages during the generation of Client Manager reports.

Affected upstream versions: < 6.6
Fixed upstream versions: SQUID_6_6
Upstream repository: https://github.com/squid-cache/squid
Upstream fix commit: 290ae202883ac28a48867079c2fb34c40efd382b
CVE-2024-23829: python-aiohttp: http request smuggling
Component: python-aiohttp
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2024-01-30T00:00:00+00:00

An HTTP request smuggling vulnerability was found in aiohttp. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets that must trigger error handling to robustly match frame boundaries of proxies in order to protect against the injection of additional requests.


Affected upstream versions: < 3.9.2
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: 33ccdfb0a12690af5bb49bda2319ec0907fa7827
CVE-2024-24557: moby: classic builder cache poisoning
Component: moby
Severity: Moderate
CWE: CWE-494 (Download of Code Without Integrity Check)
CVSS v3: 6.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L)
Public date: 2024-02-01T00:00:00+00:00

A vulnerability was found in github.com/moby/moby. The classic builder cache system in moby is vulnerable to cache poisoning if the image is built using a 'FROM scratch' in Dockerfile. This flaw allows an attacker who has knowledge of the Dockerfile to create a malicious cache that would be pulled and considered a valid cache candidate for some build steps.
This only affects one if using DOCKER_BUILDKIT=0 or using the /build API endpoint.

Statement: Red Hat rates this as a Moderate impact since attack complexity is quite high. There are multiple conditions which are required: dockerfile is configured to use a non-default setting, attacker must be aware of this information, and they must have the ability to craft a malicious cache.

Affected upstream versions: >= 25.0.0, < 25.0.2,  < 24.0.9
Fixed upstream versions: client/v0.1.0
Upstream repository: https://github.com/moby/moby
Upstream fix commit: 3e230cfdcc989dc524882f6579f9e0dac77400ae
CVE-2024-24806: libuv: Improper Domain Lookup that potentially leads to SSRF attacks
Component: libuv
Severity: Moderate
CWE: CWE-918 (Server-Side Request Forgery (SSRF))
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2024-02-07T00:00:00+00:00

A server-side request forgery (SSRF) flaw was found in the libuv package due to how the `hostname_ascii` variable is handled in `uv_getaddrinfo` and `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result, attackers may be able to access internal APIs or for websites that allow users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks.

Statement: The CVE-2024-24806 vulnerability in libuv, can be classified as a moderate severity issue rather than critical due to several mitigating factors. Firstly, the exploit requires specific conditions to be met, including the use of hostnames exceeding 256 characters, limiting its applicability. Additionally, the vulnerability primarily exposes servers to SSRF attacks and unauthorized access to internal APIs, rather than facilitating direct system compromise or data exfiltration. Furthermore, the exploit's detection and exploitation require a degree of sophistication, reducing the likelihood of widespread exploitation. While the potential impact on systems leveraging libuv is notable, prudent security measures, such as network controls and vigilant monitoring, can effectively mitigate the risk, thus warranting a moderate severity classification.

Affected upstream versions: >= 1.45.0, < 1.48.0
Fixed upstream versions: v1.48.0
Upstream repository: https://github.com/libuv/libuv
Upstream fix commit: 0f2d7e784a256b54b2385043438848047bc2a629
CVE-2024-24814: mod_auth_openidc: DoS when using `OIDCSessionType client-cookie` and manipulating cookies
Component: mod_auth_openidc
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-13T00:00:00+00:00

A flaw was found in mod_auth_openidc, an OpenID Certified™ authentication and authorization module for the Apache HTTP server. Missing input validation in the mod_auth_openidc_session_chunks cookie value can make the server vulnerable to a denial of service attack. This issue may allow a remote attacker to craft a request that causes the application or system to slow down or crash due to unhandled errors.

Statement: The identified vulnerability in the application's handling of the mod_auth_openidc_session_chunks cookie represents a moderate severity issue rather than a important one due to several factors. While the ability for attackers to craft requests causing server strain and potential unresponsiveness poses a threat to the availability of the service, it requires specific conditions to exploit. The attack relies on manipulating a specific cookie with an exceptionally large value, which may not be easily achievable without user interaction or prior access to the system. Additionally, the impact is limited to denial of service rather than compromising sensitive data or system integrity.

Affected upstream versions: >= 2.0.0, < 2.4.15.2
Fixed upstream versions: v2.4.15.2
Upstream repository: https://github.com/OpenIDC/mod_auth_openidc
Upstream fix commit: 4022c12f314bd89d127d1be008b1a80a08e1203d
CVE-2024-2511: openssl: Unbounded memory growth with session handling in TLSv1.3
Component: openssl
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-04-08T00:00:00+00:00

A flaw was found in OpenSSL. A malicious client can trigger an uncontrolled memory consumption, resulting in a Denial of Service. This issue occurs due to OpenSSL's TLSv1.3 session cache going into an incorrect state, leading to it failing to flush properly as it fills. OpenSSL must be configured with the non-default SSL_OP_NO_TICKET option enabled to be vulnerable. This issue only affects TLSv1.3 servers, while TLS clients are not affected.

Statement: The OpenSSL version shipped with Red Hat Enterprise Linux 7 is not affected by this issue, as the version 1.0.2 does not contain the related bug.

Affected upstream versions: 3.2.0 < 3.2.2, 3.1.0 < 3.1.6, 3.0.0 < 3.0.14, 1.1.1 < 1.1.1y
Fixed upstream versions: 1.1.1y, 3.0.14, 3.1.6, 3.2.2
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: e9d7083e241670332e0443da0f0d4ffb52829f08
CVE-2024-25126: rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing
Component: rubygem-rack
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-02-22T00:00:00+00:00

A denial of service (DoS) vulnerability was found in rubygem-rack in how it parses Content-Type. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability.


Affected upstream versions: >= 3.0.0, < 3.0.9.1, >= 0.4, < 2.2.8.1
Fixed upstream versions: v3.0.9.1
Upstream repository: https://github.com/rack/rack
Upstream fix commit: 6efb2ceea003c4b195815a614e00438cbd543462
CVE-2024-25617: squid: denial of service in HTTP header parser
Component: squid
Severity: Important
CWE: CWE-182 (Collapse of Data into Unsafe Value)
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Public date: 2024-02-14T00:00:00+00:00

A flaw was found in Squid. This issue may allow a remote client or remote server to trigger a denial of service when sending oversized headers in HTTP messages.

Statement: This issue can be exploitable when the Squid request_header_max_size and reply_header_max_size configuration options have a big value, specifically, values greater than 64KB. In Squid versions prior to 6.5, the default value of these options are unsafe.
The Squid package as shipped in Red Hat Enterprise Linux 7, 8 and 9 has an unsafe default configuration and is vulnerable to this issue.

Affected upstream versions: < 6.5
Fixed upstream versions: SQUID_6_5
Upstream repository: https://github.com/squid-cache/squid
Upstream fix commit: 72a3bbd5e431597c3fdb56d752bc56b010ba3817
CVE-2024-25620: helm: Dependency management path traversal
Component: helm
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
Public date: 2024-02-15T00:00:00+00:00

A path traversal vulnerability was found in Helm when it saved a chart including download time. When either the Helm client or SDK is used to save a chart whose name is within the Chart.yaml file and includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name.


Affected upstream versions: < 3.14.1
Fixed upstream versions: v3.15.0
Upstream repository: https://github.com/helm/helm
Upstream fix commit: 0d0f91d1ce277b2c8766cdc4c7aa04dbafbf2503
CVE-2024-25621: github.com/containerd/containerd: containerd local privilege escalation
Component: github.com/containerd/containerd
Severity: Important
CWE: CWE-279 (Incorrect Execution-Assigned Permissions)
CVSS v3: 7.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L)
Public date: 2025-11-06T18:36:21.566000+00:00

A local privilege escalation vulnerability has been discovered in containerd. This vulnerability is the result of an overly broad default permission which allows local users on the host to potentially access the metadata store, the content store and the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.


Affected upstream versions: < 1.7.29, >= 2.0.0-beta.0, < 2.0.7, >= 2.1.0-beta.0, < 2.1.5, >= 2.2.0-beta.0, < 2.2.0
Fixed upstream versions: api/v1.11.0
Upstream repository: https://github.com/containerd/containerd
Upstream fix commit: 7c59e8e9e970d38061a77b586b23655c352bfec5
CVE-2024-25629: c-ares: Out of bounds read in ares__read_line()
Component: c-ares
Severity: Low
CWE: CWE-127 (Buffer Under-read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-23T00:00:00+00:00

A vulnerability was found in c-ares where the ares__read_line() is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.22.0, the /etc/hosts file. If the configuration files have an embedded NULL character as the first character in a new line, it can attempt to read memory before the start of the given buffer, which may result in a crash.

Statement: Red Hat considers this a Low impact since this issue requires a specific configuration file to be configured incorrectly, meaning an attacker would need access to this configuration file to impact the server. This would normally correspond to an already compromised environment.

Affected upstream versions: < 1.27.0
Fixed upstream versions: cares-1_27_0
Upstream repository: https://github.com/c-ares/c-ares
Upstream fix commit: a804c04ddc8245fc8adf0e92368709639125e183