Releases: c-ares/c-ares
1.24.0
1.23.0
1.22.1
1.22.0
1.21.0
1.20.1
1.20.0
1.19.1
c-ares version 1.19.1
This is a security and bugfix release.
A special thanks goes out to the Open Source Technology Improvement Fund
(https://ostif.org) for sponsoring a security audit of c-ares performed by X41
(https://x41-dsec.de).
Security
o CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service [12]
o CVE-2023-31147. Moderate. Insufficient randomness in generation of DNS
query IDs [13]
o CVE-2023-31130. Moderate. Buffer Underwrite in ares_inet_net_pton() [14]
o CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE during cross
compilation [15]
Bug fixes
o Fix uninitialized memory warning in test [1]
o Turn off IPV6_V6ONLY on Windows to allow IPv4-mapped IPv6 addresses [2]
o ares_getaddrinfo() should allow a port of 0 [3]
o Fix memory leak in ares_send() on error [4]
o Fix comment style in ares_data.h [5]
o Remove unneeded ifdef for Windows [6]
o Fix typo in ares_init_options.3 [7]
o Re-add support for Watcom compiler [8]
o Sync ax_pthread.m4 with upstream [9]
o Windows: Invalid stack variable used out of scope for HOSTS path [10]
o Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support [11]
Thanks go to these friendly people for their efforts and contributions:
Brad House (@bradh352)
@Chilledheart
Daniel Stenberg (@bagder)
Douglas R. Reno (@renodr)
Gregor Jasny (@gjasny)
Jay Freeman (@saurik)
@lifenjoiner
Nikolaos Chatzikonstantinou (@createyourpersonalaccount)
Yijie Ma (@yijiem)
(9 contributors)
References to bug reports and discussions on issues:
[1] = #515
[2] = #520
[3] = #517
[4] = #511
[5] = #513
[6] = #512
[7] = #510
[8] = #509
[9] = #507
[10] = #502
[11] = #505
[12] = GHSA-9g78-jv2r-p7vc
[13] = GHSA-8r8p-23f3-64c2
[14] = GHSA-x6mf-cxr9-8q6v
[15] = GHSA-54xr-f67r-4pc4