From 529f4fc683b7a05e9d705597cf8550facb4bccc1 Mon Sep 17 00:00:00 2001 From: xinghe Date: Mon, 29 May 2023 11:03:54 +0000 Subject: [PATCH] fix CVE-2023-31124 CVE-2023-31147 (cherry picked from commit 1d0b83e4f3dd69c4f85baa41fe1beda940d2c2e3) --- backport-001-CVE-2023-31147.patch | 712 ++++++++++++++++++ ...rt-002-CVE-2023-31124_CVE-2023-31147.patch | 277 +++++++ backport-003-CVE-2023-31147.patch | 32 + backport-004-CVE-2023-31147.patch | 33 + backport-005-CVE-2023-31147.patch | 36 + backport-CVE-2023-31124.patch | 71 ++ c-ares.spec | 14 +- 7 files changed, 1174 insertions(+), 1 deletion(-) create mode 100644 backport-001-CVE-2023-31147.patch create mode 100644 backport-002-CVE-2023-31124_CVE-2023-31147.patch create mode 100644 backport-003-CVE-2023-31147.patch create mode 100644 backport-004-CVE-2023-31147.patch create mode 100644 backport-005-CVE-2023-31147.patch create mode 100644 backport-CVE-2023-31124.patch diff --git a/backport-001-CVE-2023-31147.patch b/backport-001-CVE-2023-31147.patch new file mode 100644 index 0000000..3be1fa1 --- /dev/null +++ b/backport-001-CVE-2023-31147.patch @@ -0,0 +1,712 @@ +From 823df3b989e59465d17b0a2eb1239a5fc048b4e5 Mon Sep 17 00:00:00 2001 +From: Brad House +Date: Mon, 22 May 2023 06:51:06 -0400 +Subject: [PATCH] Merge pull request from GHSA-8r8p-23f3-64c2 + +* segment random number generation into own file + +* abstract random code to make it more modular so we can have multiple backends + +* rand: add support for arc4random_buf() and also direct CARES_RANDOM_FILE reading + +* autotools: fix detection of arc4random_buf + +* rework initial rc4 seed for PRNG as last fallback + +* rc4: more proper implementation, simplified for clarity + +* clarifications + +Conflict:NA +Reference:https://github.com/c-ares/c-ares/commit/823df3b989e59465d17b0a2eb1239a5fc048b4e5 +--- + CMakeLists.txt | 2 + + configure.ac | 1 + + m4/cares-functions.m4 | 85 +++++++++++ + src/lib/Makefile.inc | 1 + + src/lib/ares_config.h.cmake | 3 + + src/lib/ares_destroy.c | 3 + + src/lib/ares_init.c | 89 ++---------- + src/lib/ares_private.h | 19 ++- + src/lib/ares_query.c | 36 +---- + src/lib/ares_rand.c | 274 ++++++++++++++++++++++++++++++++++++ + 10 files changed, 387 insertions(+), 126 deletions(-) + create mode 100644 src/lib/ares_rand.c + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 3987d0ab7..e2290af10 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -393,6 +393,8 @@ CHECK_SYMBOL_EXISTS (strncasecmp "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_STRNCAS + CHECK_SYMBOL_EXISTS (strncmpi "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_STRNCMPI) + CHECK_SYMBOL_EXISTS (strnicmp "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_STRNICMP) + CHECK_SYMBOL_EXISTS (writev "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_WRITEV) ++CHECK_SYMBOL_EXISTS (arc4random_buf "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_ARC4RANDOM_BUF) ++ + + # On Android, the system headers may define __system_property_get(), but excluded + # from libc. We need to perform a link test instead of a header/symbol test. +diff --git a/configure.ac b/configure.ac +index 7884cbb26..54e79d6e2 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -683,6 +683,7 @@ CARES_CHECK_FUNC_STRNCASECMP + CARES_CHECK_FUNC_STRNCMPI + CARES_CHECK_FUNC_STRNICMP + CARES_CHECK_FUNC_WRITEV ++CARES_CHECK_FUNC_ARC4RANDOM_BUF + + + dnl check for AF_INET6 +diff --git a/m4/cares-functions.m4 b/m4/cares-functions.m4 +index 0f3992c7f..d4f4f994c 100644 +--- a/m4/cares-functions.m4 ++++ b/m4/cares-functions.m4 +@@ -3753,3 +3753,88 @@ AC_DEFUN([CARES_CHECK_FUNC_WRITEV], [ + ac_cv_func_writev="no" + fi + ]) ++ ++dnl CARES_CHECK_FUNC_ARC4RANDOM_BUF ++dnl ------------------------------------------------- ++dnl Verify if arc4random_buf is available, prototyped, and ++dnl can be compiled. If all of these are true, and ++dnl usage has not been previously disallowed with ++dnl shell variable cares_disallow_arc4random_buf, then ++dnl HAVE_ARC4RANDOM_BUF will be defined. ++ ++AC_DEFUN([CARES_CHECK_FUNC_ARC4RANDOM_BUF], [ ++ AC_REQUIRE([CARES_INCLUDES_STDLIB])dnl ++ # ++ tst_links_arc4random_buf="unknown" ++ tst_proto_arc4random_buf="unknown" ++ tst_compi_arc4random_buf="unknown" ++ tst_allow_arc4random_buf="unknown" ++ # ++ AC_MSG_CHECKING([if arc4random_buf can be linked]) ++ AC_LINK_IFELSE([ ++ AC_LANG_FUNC_LINK_TRY([arc4random_buf]) ++ ],[ ++ AC_MSG_RESULT([yes]) ++ tst_links_arc4random_buf="yes" ++ ],[ ++ AC_MSG_RESULT([no]) ++ tst_links_arc4random_buf="no" ++ ]) ++ # ++ if test "$tst_links_arc4random_buf" = "yes"; then ++ AC_MSG_CHECKING([if arc4random_buf is prototyped]) ++ AC_EGREP_CPP([arc4random_buf],[ ++ $cares_includes_stdlib ++ ],[ ++ AC_MSG_RESULT([yes]) ++ tst_proto_arc4random_buf="yes" ++ ],[ ++ AC_MSG_RESULT([no]) ++ tst_proto_arc4random_buf="no" ++ ]) ++ fi ++ # ++ if test "$tst_proto_arc4random_buf" = "yes"; then ++ AC_MSG_CHECKING([if arc4random_buf is compilable]) ++ AC_COMPILE_IFELSE([ ++ AC_LANG_PROGRAM([[ ++ $cares_includes_stdlib ++ ]],[[ ++ arc4random_buf(NULL, 0); ++ return 1; ++ ]]) ++ ],[ ++ AC_MSG_RESULT([yes]) ++ tst_compi_arc4random_buf="yes" ++ ],[ ++ AC_MSG_RESULT([no]) ++ tst_compi_arc4random_buf="no" ++ ]) ++ fi ++ # ++ if test "$tst_compi_arc4random_buf" = "yes"; then ++ AC_MSG_CHECKING([if arc4random_buf usage allowed]) ++ if test "x$cares_disallow_arc4random_buf" != "xyes"; then ++ AC_MSG_RESULT([yes]) ++ tst_allow_arc4random_buf="yes" ++ else ++ AC_MSG_RESULT([no]) ++ tst_allow_arc4random_buf="no" ++ fi ++ fi ++ # ++ AC_MSG_CHECKING([if arc4random_buf might be used]) ++ if test "$tst_links_arc4random_buf" = "yes" && ++ test "$tst_proto_arc4random_buf" = "yes" && ++ test "$tst_compi_arc4random_buf" = "yes" && ++ test "$tst_allow_arc4random_buf" = "yes"; then ++ AC_MSG_RESULT([yes]) ++ AC_DEFINE_UNQUOTED(HAVE_ARC4RANDOM_BUF, 1, ++ [Define to 1 if you have the arc4random_buf function.]) ++ ac_cv_func_arc4random_buf="yes" ++ else ++ AC_MSG_RESULT([no]) ++ ac_cv_func_arc4random_buf="no" ++ fi ++]) ++ +diff --git a/src/lib/Makefile.inc b/src/lib/Makefile.inc +index 140378d67..49bbe6016 100644 +--- a/src/lib/Makefile.inc ++++ b/src/lib/Makefile.inc +@@ -45,6 +45,7 @@ CSOURCES = ares__addrinfo2hostent.c \ + ares_platform.c \ + ares_process.c \ + ares_query.c \ ++ ares_rand.c \ + ares_search.c \ + ares_send.c \ + ares_strcasecmp.c \ +diff --git a/src/lib/ares_config.h.cmake b/src/lib/ares_config.h.cmake +index fddb78535..798820a3a 100644 +--- a/src/lib/ares_config.h.cmake ++++ b/src/lib/ares_config.h.cmake +@@ -346,6 +346,9 @@ + /* Define to 1 if you need the memory.h header file even with stdlib.h */ + #cmakedefine NEED_MEMORY_H + ++/* Define if have arc4random_buf() */ ++#cmakedefine HAVE_ARC4RANDOM_BUF ++ + /* a suitable file/device to read random data from */ + #cmakedefine CARES_RANDOM_FILE "@CARES_RANDOM_FILE@" + +diff --git a/src/lib/ares_destroy.c b/src/lib/ares_destroy.c +index 7ec2bde5a..62c899f82 100644 +--- a/src/lib/ares_destroy.c ++++ b/src/lib/ares_destroy.c +@@ -95,6 +95,9 @@ void ares_destroy(ares_channel channel) + if (channel->resolvconf_path) + ares_free(channel->resolvconf_path); + ++ if (channel->rand_state) ++ ares__destroy_rand_state(channel->rand_state); ++ + ares_free(channel); + } + +diff --git a/src/lib/ares_init.c b/src/lib/ares_init.c +index c7ca7af1b..0519f43e5 100644 +--- a/src/lib/ares_init.c ++++ b/src/lib/ares_init.c +@@ -87,7 +76,6 @@ static int config_nameserver(struct server_state **servers, int *nservers, + static int set_search(ares_channel channel, const char *str); + static int set_options(ares_channel channel, const char *str); + static const char *try_option(const char *p, const char *q, const char *opt); +-static int init_id_key(rc4_key* key,int key_data_len); + + static int config_sortlist(struct apattern **sortlist, int *nsort, + const char *str); +@@ -165,6 +153,7 @@ int ares_init_options(ares_channel *channelptr, struct ares_options *options, + channel->sock_funcs = NULL; + channel->sock_func_cb_data = NULL; + channel->resolvconf_path = NULL; ++ channel->rand_state = NULL; + + channel->last_server = 0; + channel->last_timeout_processed = (time_t)now.tv_sec; +@@ -218,9 +207,13 @@ int ares_init_options(ares_channel *channelptr, struct ares_options *options, + /* Generate random key */ + + if (status == ARES_SUCCESS) { +- status = init_id_key(&channel->id_key, ARES_ID_KEY_LEN); ++ channel->rand_state = ares__init_rand_state(); ++ if (channel->rand_state == NULL) { ++ status = ARES_ENOMEM; ++ } ++ + if (status == ARES_SUCCESS) +- channel->next_id = ares__generate_new_id(&channel->id_key); ++ channel->next_id = ares__generate_new_id(channel->rand_state); + else + DEBUGF(fprintf(stderr, "Error: init_id_key failed: %s\n", + ares_strerror(status))); +@@ -242,6 +235,8 @@ int ares_init_options(ares_channel *channelptr, struct ares_options *options, + ares_free(channel->lookups); + if(channel->resolvconf_path) + ares_free(channel->resolvconf_path); ++ if (channel->rand_state) ++ ares__destroy_rand_state(channel->rand_state); + ares_free(channel); + return status; + } +@@ -2182,76 +2177,6 @@ static int sortlist_alloc(struct apattern **sortlist, int *nsort, + return 1; + } + +-/* initialize an rc4 key. If possible a cryptographically secure random key +- is generated using a suitable function (for example win32's RtlGenRandom as +- described in +- http://blogs.msdn.com/michael_howard/archive/2005/01/14/353379.aspx +- otherwise the code defaults to cross-platform albeit less secure mechanism +- using rand +-*/ +-static void randomize_key(unsigned char* key,int key_data_len) +-{ +- int randomized = 0; +- int counter=0; +-#ifdef WIN32 +- BOOLEAN res; +- if (ares_fpSystemFunction036) +- { +- res = (*ares_fpSystemFunction036) (key, key_data_len); +- if (res) +- randomized = 1; +- } +-#else /* !WIN32 */ +-#ifdef CARES_RANDOM_FILE +- FILE *f = fopen(CARES_RANDOM_FILE, "rb"); +- if(f) { +- setvbuf(f, NULL, _IONBF, 0); +- counter = aresx_uztosi(fread(key, 1, key_data_len, f)); +- fclose(f); +- } +-#endif +-#endif /* WIN32 */ +- +- if (!randomized) { +- for (;counterstate[0]; +- for(counter = 0; counter < 256; counter++) +- /* unnecessary AND but it keeps some compilers happier */ +- state[counter] = (unsigned char)(counter & 0xff); +- randomize_key(key->state,key_data_len); +- key->x = 0; +- key->y = 0; +- index1 = 0; +- index2 = 0; +- for(counter = 0; counter < 256; counter++) +- { +- index2 = (unsigned char)((key_data_ptr[index1] + state[counter] + +- index2) % 256); +- ARES_SWAP_BYTE(&state[counter], &state[index2]); +- +- index1 = (unsigned char)((index1 + 1) % key_data_len); +- } +- ares_free(key_data_ptr); +- return ARES_SUCCESS; +-} +- + void ares_set_local_ip4(ares_channel channel, unsigned int local_ip) + { + channel->local_ip4 = local_ip; +diff --git a/src/lib/ares_private.h b/src/lib/ares_private.h +index 53043a651..b6eab8a7d 100644 +--- a/src/lib/ares_private.h ++++ b/src/lib/ares_private.h +@@ -101,8 +101,6 @@ W32_FUNC const char *_w32_GetHostsFile (void); + + #endif + +-#define ARES_ID_KEY_LEN 31 +- + #include "ares_ipv6.h" + #include "ares_llist.h" + +@@ -262,12 +260,8 @@ struct apattern { + unsigned short type; + }; + +-typedef struct rc4_key +-{ +- unsigned char state[256]; +- unsigned char x; +- unsigned char y; +-} rc4_key; ++struct ares_rand_state; ++typedef struct ares_rand_state ares_rand_state; + + struct ares_channeldata { + /* Configuration data */ +@@ -302,8 +296,8 @@ struct ares_channeldata { + + /* ID to use for next query */ + unsigned short next_id; +- /* key to use when generating new ids */ +- rc4_key id_key; ++ /* random state to use when generating new ids */ ++ ares_rand_state *rand_state; + + /* Generation number to use for the next TCP socket open/close */ + int tcp_connection_generation; +@@ -362,7 +356,10 @@ void ares__close_sockets(ares_channel channel, struct server_state *server); + int ares__get_hostent(FILE *fp, int family, struct hostent **host); + int ares__read_line(FILE *fp, char **buf, size_t *bufsize); + void ares__free_query(struct query *query); +-unsigned short ares__generate_new_id(rc4_key* key); ++ ++ares_rand_state *ares__init_rand_state(void); ++void ares__destroy_rand_state(ares_rand_state *state); ++unsigned short ares__generate_new_id(ares_rand_state *state); + struct timeval ares__tvnow(void); + int ares__expand_name_validated(const unsigned char *encoded, + const unsigned char *abuf, +diff --git a/src/lib/ares_query.c b/src/lib/ares_query.c +index 508274db3..42323bec5 100644 +--- a/src/lib/ares_query.c ++++ b/src/lib/ares_query.c +@@ -33,32 +33,6 @@ struct qquery { + + static void qcallback(void *arg, int status, int timeouts, unsigned char *abuf, int alen); + +-static void rc4(rc4_key* key, unsigned char *buffer_ptr, int buffer_len) +-{ +- unsigned char x; +- unsigned char y; +- unsigned char* state; +- unsigned char xorIndex; +- int counter; +- +- x = key->x; +- y = key->y; +- +- state = &key->state[0]; +- for(counter = 0; counter < buffer_len; counter ++) +- { +- x = (unsigned char)((x + 1) % 256); +- y = (unsigned char)((state[x] + y) % 256); +- ARES_SWAP_BYTE(&state[x], &state[y]); +- +- xorIndex = (unsigned char)((state[x] + state[y]) % 256); +- +- buffer_ptr[counter] = (unsigned char)(buffer_ptr[counter]^state[xorIndex]); +- } +- key->x = x; +- key->y = y; +-} +- + static struct query* find_query_by_id(ares_channel channel, unsigned short id) + { + unsigned short qid; +@@ -78,7 +52,6 @@ static struct query* find_query_by_id(ares_channel channel, unsigned short id) + return NULL; + } + +- + /* a unique query id is generated using an rc4 key. Since the id may already + be used by a running query (as infrequent as it may be), a lookup is + performed per id generation. In practice this search should happen only +@@ -89,19 +62,12 @@ static unsigned short generate_unique_id(ares_channel channel) + unsigned short id; + + do { +- id = ares__generate_new_id(&channel->id_key); ++ id = ares__generate_new_id(channel->rand_state); + } while (find_query_by_id(channel, id)); + + return (unsigned short)id; + } + +-unsigned short ares__generate_new_id(rc4_key* key) +-{ +- unsigned short r=0; +- rc4(key, (unsigned char *)&r, sizeof(r)); +- return r; +-} +- + void ares_query(ares_channel channel, const char *name, int dnsclass, + int type, ares_callback callback, void *arg) + { +diff --git a/src/lib/ares_rand.c b/src/lib/ares_rand.c +new file mode 100644 +index 000000000..a564bc236 +--- /dev/null ++++ b/src/lib/ares_rand.c +@@ -0,0 +1,274 @@ ++/* Copyright 1998 by the Massachusetts Institute of Technology. ++ * Copyright (C) 2007-2013 by Daniel Stenberg ++ * ++ * Permission to use, copy, modify, and distribute this ++ * software and its documentation for any purpose and without ++ * fee is hereby granted, provided that the above copyright ++ * notice appear in all copies and that both that copyright ++ * notice and this permission notice appear in supporting ++ * documentation, and that the name of M.I.T. not be used in ++ * advertising or publicity pertaining to distribution of the ++ * software without specific, written prior permission. ++ * M.I.T. makes no representations about the suitability of ++ * this software for any purpose. It is provided "as is" ++ * without express or implied warranty. ++ */ ++ ++#include "ares_setup.h" ++#include "ares.h" ++#include "ares_private.h" ++#include "ares_nowarn.h" ++#include ++ ++typedef enum { ++ ARES_RAND_OS = 1, /* OS-provided such as RtlGenRandom or arc4random */ ++ ARES_RAND_FILE = 2, /* OS file-backed random number generator */ ++ ARES_RAND_RC4 = 3 /* Internal RC4 based PRNG */ ++} ares_rand_backend; ++ ++typedef struct ares_rand_rc4 ++{ ++ unsigned char S[256]; ++ size_t i; ++ size_t j; ++} ares_rand_rc4; ++ ++struct ares_rand_state ++{ ++ ares_rand_backend type; ++ union { ++ FILE *rand_file; ++ ares_rand_rc4 rc4; ++ } state; ++}; ++ ++ ++/* Define RtlGenRandom = SystemFunction036. This is in advapi32.dll. There is ++ * no need to dynamically load this, other software used widely does not. ++ * http://blogs.msdn.com/michael_howard/archive/2005/01/14/353379.aspx ++ * https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-rtlgenrandom ++ */ ++#ifdef _WIN32 ++BOOLEAN WINAPI SystemFunction036(PVOID RandomBuffer, ULONG RandomBufferLength); ++# ifndef RtlGenRandom ++# define RtlGenRandom(a,b) SystemFunction036(a,b) ++# endif ++#endif ++ ++ ++#define ARES_RC4_KEY_LEN 32 /* 256 bits */ ++ ++static unsigned int ares_u32_from_ptr(void *addr) ++{ ++ if (sizeof(void *) == 8) { ++ return (unsigned int)((((size_t)addr >> 32) & 0xFFFFFFFF) | ((size_t)addr & 0xFFFFFFFF)); ++ } ++ return (unsigned int)((size_t)addr & 0xFFFFFFFF); ++} ++ ++ ++/* initialize an rc4 key as the last possible fallback. */ ++static void ares_rc4_generate_key(ares_rand_rc4 *rc4_state, unsigned char *key, size_t key_len) ++{ ++ size_t i; ++ size_t len = 0; ++ unsigned int data; ++ struct timeval tv; ++ ++ if (key_len != ARES_RC4_KEY_LEN) ++ return; ++ ++ /* Randomness is hard to come by. Maybe the system randomizes heap and stack addresses. ++ * Maybe the current timestamp give us some randomness. ++ * Use rc4_state (heap), &i (stack), and ares__tvnow() ++ */ ++ data = ares_u32_from_ptr(rc4_state); ++ memcpy(key + len, &data, sizeof(data)); ++ len += sizeof(data); ++ ++ data = ares_u32_from_ptr(&i); ++ memcpy(key + len, &data, sizeof(data)); ++ len += sizeof(data); ++ ++ tv = ares__tvnow(); ++ data = (unsigned int)((tv.tv_sec | tv.tv_usec) & 0xFFFFFFFF); ++ memcpy(key + len, &data, sizeof(data)); ++ len += sizeof(data); ++ ++ srand(ares_u32_from_ptr(rc4_state) | ares_u32_from_ptr(&i) | (unsigned int)((tv.tv_sec | tv.tv_usec) & 0xFFFFFFFF)); ++ ++ for (i=len; iS); i++) { ++ rc4_state->S[i] = i & 0xFF; ++ } ++ ++ for(i = 0, j = 0; i < 256; i++) { ++ j = (j + rc4_state->S[i] + key[i % sizeof(key)]) % 256; ++ ARES_SWAP_BYTE(&rc4_state->S[i], &rc4_state->S[j]); ++ } ++ ++ rc4_state->i = 0; ++ rc4_state->j = 0; ++} ++ ++/* Just outputs the key schedule, no need to XOR with any data since we have none */ ++static void ares_rc4_prng(ares_rand_rc4 *rc4_state, unsigned char *buf, int len) ++{ ++ unsigned char *S = rc4_state->S; ++ size_t i = rc4_state->i; ++ size_t j = rc4_state->j; ++ size_t cnt; ++ ++ for (cnt=0; cnti = i; ++ rc4_state->j = j; ++} ++ ++ ++static int ares__init_rand_engine(ares_rand_state *state) ++{ ++ memset(state, 0, sizeof(*state)); ++ ++#if defined(HAVE_ARC4RANDOM_BUF) || defined(_WIN32) ++ state->type = ARES_RAND_OS; ++ return 1; ++#elif defined(CARES_RANDOM_FILE) ++ state->type = ARES_RAND_FILE; ++ state->state.rand_file = fopen(CARES_RANDOM_FILE, "rb"); ++ if (state->state.rand_file) { ++ setvbuf(state->state.rand_file, NULL, _IONBF, 0); ++ return 1; ++ } ++ /* Fall-Thru on failure to RC4 */ ++#endif ++ ++ state->type = ARES_RAND_RC4; ++ ares_rc4_init(&state->state.rc4); ++ ++ /* Currently cannot fail */ ++ return 1; ++} ++ ++ ++ares_rand_state *ares__init_rand_state() ++{ ++ ares_rand_state *state = NULL; ++ ++ state = ares_malloc(sizeof(*state)); ++ if (!state) ++ return NULL; ++ ++ if (!ares__init_rand_engine(state)) { ++ ares_free(state); ++ return NULL; ++ } ++ ++ return state; ++} ++ ++ ++static void ares__clear_rand_state(ares_rand_state *state) ++{ ++ if (!state) ++ return; ++ ++ switch (state->type) { ++ case ARES_RAND_OS: ++ break; ++ case ARES_RAND_FILE: ++ fclose(state->state.rand_file); ++ break; ++ case ARES_RAND_RC4: ++ break; ++ } ++} ++ ++ ++static void ares__reinit_rand(ares_rand_state *state) ++{ ++ ares__clear_rand_state(state); ++ ares__init_rand_engine(state); ++} ++ ++ ++void ares__destroy_rand_state(ares_rand_state *state) ++{ ++ if (!state) ++ return; ++ ++ ares__clear_rand_state(state); ++ ares_free(state); ++} ++ ++ ++static void ares__rand_bytes(ares_rand_state *state, unsigned char *buf, size_t len) ++{ ++ ++ while (1) { ++ size_t rv; ++ size_t bytes_read = 0; ++ ++ switch (state->type) { ++ case ARES_RAND_OS: ++#ifdef _WIN32 ++ RtlGenRandom(buf, len); ++ return; ++#elif defined(HAVE_ARC4RANDOM_BUF) ++ arc4random_buf(buf, len); ++ return; ++#else ++ /* Shouldn't be possible to be here */ ++ break; ++#endif ++ ++ case ARES_RAND_FILE: ++ while (1) { ++ size_t rv = fread(buf + bytes_read, 1, len - bytes_read, state->state.rand_file); ++ if (rv == 0) ++ break; /* critical error, will reinit rand state */ ++ ++ bytes_read += rv; ++ if (bytes_read == len) ++ return; ++ } ++ break; ++ ++ case ARES_RAND_RC4: ++ ares_rc4_prng(&state->state.rc4, buf, len); ++ return; ++ } ++ ++ /* If we didn't return before we got here, that means we had a critical rand ++ * failure and need to reinitialized */ ++ ares__reinit_rand(state); ++ } ++} ++ ++unsigned short ares__generate_new_id(ares_rand_state *state) ++{ ++ unsigned short r=0; ++ ++ ares__rand_bytes(state, (unsigned char *)&r, sizeof(r)); ++ return r; ++} ++ diff --git a/backport-002-CVE-2023-31124_CVE-2023-31147.patch b/backport-002-CVE-2023-31124_CVE-2023-31147.patch new file mode 100644 index 0000000..14f5728 --- /dev/null +++ b/backport-002-CVE-2023-31124_CVE-2023-31147.patch @@ -0,0 +1,277 @@ +From 69950390b2d8063b6540dc75941a30ea56d11918 Mon Sep 17 00:00:00 2001 +From: Ben Noordhuis +Date: Thu, 25 May 2023 21:31:33 +0200 +Subject: [PATCH] rand: add support for getrandom() (#526) + +glibc provides arc4random_buf() but musl does not and /dev/urandom is +not always available. + +Conflict: NA +Reference: https://github.com/c-ares/c-ares/commit/69950390b2d8063b6540dc75941a30ea56d11918 +--- + CMakeLists.txt | 6 +++ + configure.ac | 1 + + include/ares_build.h.cmake | 5 ++ + m4/cares-functions.m4 | 102 ++++++++++++++++++++++++++++++++++++ + src/lib/ares_config.h.cmake | 3 ++ + src/lib/ares_rand.c | 17 +++++- + src/lib/setup_once.h | 4 ++ + 7 files changed, 137 insertions(+), 1 deletion(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index e2290af10..0a403880a 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -164,6 +164,7 @@ CARES_FUNCTION_IN_LIBRARY (clock_gettime rt HAVE_LIBRT) + + # Look for necessary includes + CHECK_INCLUDE_FILES (sys/types.h HAVE_SYS_TYPES_H) ++CHECK_INCLUDE_FILES (sys/random.h HAVE_SYS_RANDOM_H) + CHECK_INCLUDE_FILES (sys/socket.h HAVE_SYS_SOCKET_H) + CHECK_INCLUDE_FILES (sys/sockio.h HAVE_SYS_SOCKIO_H) + CHECK_INCLUDE_FILES (arpa/inet.h HAVE_ARPA_INET_H) +@@ -281,6 +282,7 @@ CARES_EXTRAINCLUDE_IFSET (HAVE_STDLIB_H stdlib.h) + CARES_EXTRAINCLUDE_IFSET (HAVE_STRING_H string.h) + CARES_EXTRAINCLUDE_IFSET (HAVE_STRINGS_H strings.h) + CARES_EXTRAINCLUDE_IFSET (HAVE_SYS_IOCTL_H sys/ioctl.h) ++CARES_EXTRAINCLUDE_IFSET (HAVE_SYS_RANDOM_H sys/random.h) + CARES_EXTRAINCLUDE_IFSET (HAVE_SYS_SELECT_H sys/select.h) + CARES_EXTRAINCLUDE_IFSET (HAVE_SYS_SOCKET_H sys/socket.h) + CARES_EXTRAINCLUDE_IFSET (HAVE_SYS_SOCKIO_H sys/sockio.h) +@@ -365,6 +367,7 @@ CHECK_SYMBOL_EXISTS (gethostbyaddr "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_GETHOST + CHECK_SYMBOL_EXISTS (gethostbyname "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_GETHOSTBYNAME) + CHECK_SYMBOL_EXISTS (gethostname "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_GETHOSTNAME) + CHECK_SYMBOL_EXISTS (getnameinfo "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_GETNAMEINFO) ++CHECK_SYMBOL_EXISTS (getrandom "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_GETRANDOM) + CHECK_SYMBOL_EXISTS (getservbyport_r "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_GETSERVBYPORT_R) + CHECK_SYMBOL_EXISTS (getservbyname_r "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_GETSERVBYNAME_R) + CHECK_SYMBOL_EXISTS (gettimeofday "${CMAKE_EXTRA_INCLUDE_FILES}" HAVE_GETTIMEOFDAY) +@@ -562,6 +565,9 @@ ENDIF () + IF (HAVE_SYS_TYPES_H) + SET (CARES_HAVE_SYS_TYPES_H 1) + ENDIF () ++IF (HAVE_SYS_RANDOM_H) ++ SET (CARES_HAVE_SYS_RANDOM_H 1) ++ENDIF() + IF (HAVE_SYS_SOCKET_H) + SET (CARES_HAVE_SYS_SOCKET_H 1) + ENDIF() +diff --git a/configure.ac b/configure.ac +index 54e79d6e2..2d65eb73c 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -666,6 +666,7 @@ CARES_CHECK_FUNC_GETENV + CARES_CHECK_FUNC_GETHOSTBYADDR + CARES_CHECK_FUNC_GETHOSTBYNAME + CARES_CHECK_FUNC_GETHOSTNAME ++CARES_CHECK_FUNC_GETRANDOM + CARES_CHECK_FUNC_GETSERVBYPORT_R + CARES_CHECK_FUNC_INET_NET_PTON + CARES_CHECK_FUNC_INET_NTOP +diff --git a/include/ares_build.h.cmake b/include/ares_build.h.cmake +index e847f17ea..6bad69a21 100644 +--- a/include/ares_build.h.cmake ++++ b/include/ares_build.h.cmake +@@ -8,6 +8,7 @@ + * files. We need to include some dependent headers that may be system specific + * for C-Ares */ + #cmakedefine CARES_HAVE_SYS_TYPES_H ++#cmakedefine CARES_HAVE_SYS_RANDOM_H + #cmakedefine CARES_HAVE_SYS_SOCKET_H + #cmakedefine CARES_HAVE_WINDOWS_H + #cmakedefine CARES_HAVE_WS2TCPIP_H +@@ -20,6 +21,10 @@ + # include + #endif + ++#ifdef CARES_HAVE_SYS_RANDOM_H ++# include ++#endif ++ + #ifdef CARES_HAVE_SYS_SOCKET_H + # include + #endif +diff --git a/m4/cares-functions.m4 b/m4/cares-functions.m4 +index d4f4f994c..ce8d2f908 100644 +--- a/m4/cares-functions.m4 ++++ b/m4/cares-functions.m4 +@@ -186,6 +186,24 @@ cares_includes_stropts="\ + ]) + + ++dnl CARES_INCLUDES_SYS_RANDOM ++dnl ------------------------------------------------- ++dnl Set up variable with list of headers that must be ++dnl included when sys/random.h is to be included. ++ ++AC_DEFUN([CARES_INCLUDES_SYS_RANDOM], [ ++cares_includes_sys_random="\ ++/* includes start */ ++#ifdef HAVE_SYS_RANDOM_H ++# include ++#endif ++/* includes end */" ++ AC_CHECK_HEADERS( ++ sys/random.h, ++ [], [], [$cares_includes_sys_random]) ++]) ++ ++ + dnl CARES_INCLUDES_SYS_SOCKET + dnl ------------------------------------------------- + dnl Set up variable with list of headers that must be +@@ -1520,6 +1538,90 @@ AC_DEFUN([CARES_CHECK_FUNC_GETHOSTNAME], [ + fi + ]) + ++dnl CARES_CHECK_FUNC_GETRANDOM ++dnl ------------------------------------------------- ++dnl Verify if getrandom is available, prototyped, and ++dnl can be compiled. If all of these are true, and ++dnl usage has not been previously disallowed with ++dnl shell variable cares_disallow_getrandom, then ++dnl HAVE_GETRANDOM will be defined. ++ ++AC_DEFUN([CARES_CHECK_FUNC_GETRANDOM], [ ++ AC_REQUIRE([CARES_INCLUDES_SYS_RANDOM])dnl ++ # ++ tst_links_getrandom="unknown" ++ tst_proto_getrandom="unknown" ++ tst_compi_getrandom="unknown" ++ tst_allow_getrandom="unknown" ++ # ++ AC_MSG_CHECKING([if getrandom can be linked]) ++ AC_LINK_IFELSE([ ++ AC_LANG_FUNC_LINK_TRY([getrandom]) ++ ],[ ++ AC_MSG_RESULT([yes]) ++ tst_links_getrandom="yes" ++ ],[ ++ AC_MSG_RESULT([no]) ++ tst_links_getrandom="no" ++ ]) ++ # ++ if test "$tst_links_getrandom" = "yes"; then ++ AC_MSG_CHECKING([if getrandom is prototyped]) ++ AC_EGREP_CPP([getrandom],[ ++ $cares_includes_sys_random ++ ],[ ++ AC_MSG_RESULT([yes]) ++ tst_proto_getrandom="yes" ++ ],[ ++ AC_MSG_RESULT([no]) ++ tst_proto_getrandom="no" ++ ]) ++ fi ++ # ++ if test "$tst_proto_getrandom" = "yes"; then ++ AC_MSG_CHECKING([if getrandom is compilable]) ++ AC_COMPILE_IFELSE([ ++ AC_LANG_PROGRAM([[ ++ $cares_includes_sys_random ++ ]],[[ ++ if(0 != getrandom(0, 0, 0)) ++ return 1; ++ ]]) ++ ],[ ++ AC_MSG_RESULT([yes]) ++ tst_compi_getrandom="yes" ++ ],[ ++ AC_MSG_RESULT([no]) ++ tst_compi_getrandom="no" ++ ]) ++ fi ++ # ++ if test "$tst_compi_getrandom" = "yes"; then ++ AC_MSG_CHECKING([if getrandom usage allowed]) ++ if test "x$cares_disallow_getrandom" != "xyes"; then ++ AC_MSG_RESULT([yes]) ++ tst_allow_getrandom="yes" ++ else ++ AC_MSG_RESULT([no]) ++ tst_allow_getrandom="no" ++ fi ++ fi ++ # ++ AC_MSG_CHECKING([if getrandom might be used]) ++ if test "$tst_links_getrandom" = "yes" && ++ test "$tst_proto_getrandom" = "yes" && ++ test "$tst_compi_getrandom" = "yes" && ++ test "$tst_allow_getrandom" = "yes"; then ++ AC_MSG_RESULT([yes]) ++ AC_DEFINE_UNQUOTED(HAVE_GETRANDOM, 1, ++ [Define to 1 if you have the getrandom function.]) ++ ac_cv_func_getrandom="yes" ++ else ++ AC_MSG_RESULT([no]) ++ ac_cv_func_getrandom="no" ++ fi ++]) ++ + + dnl CARES_CHECK_FUNC_GETSERVBYPORT_R + dnl ------------------------------------------------- +diff --git a/src/lib/ares_config.h.cmake b/src/lib/ares_config.h.cmake +index 798820a3a..db0dfe768 100644 +--- a/src/lib/ares_config.h.cmake ++++ b/src/lib/ares_config.h.cmake +@@ -123,6 +123,9 @@ + /* Define to 1 if you have the getnameinfo function. */ + #cmakedefine HAVE_GETNAMEINFO + ++/* Define to 1 if you have the getrandom function. */ ++#cmakedefine HAVE_GETRANDOM ++ + /* Define to 1 if you have the getservbyport_r function. */ + #cmakedefine HAVE_GETSERVBYPORT_R + +diff --git a/src/lib/ares_rand.c b/src/lib/ares_rand.c +index 766c1e6ea..f07d419d4 100644 +--- a/src/lib/ares_rand.c ++++ b/src/lib/ares_rand.c +@@ -155,7 +155,7 @@ static int ares__init_rand_engine(ares_rand_state *state) + { + memset(state, 0, sizeof(*state)); + +-#if defined(HAVE_ARC4RANDOM_BUF) || defined(_WIN32) ++#if defined(HAVE_ARC4RANDOM_BUF) || defined(HAVE_GETRANDOM) || defined(_WIN32) + state->type = ARES_RAND_OS; + return 1; + #elif defined(CARES_RANDOM_FILE) +@@ -241,6 +241,21 @@ static void ares__rand_bytes(ares_rand_state *state, unsigned char *buf, size_t + #elif defined(HAVE_ARC4RANDOM_BUF) + arc4random_buf(buf, len); + return; ++#elif defined(HAVE_GETRANDOM) ++ while (1) { ++ size_t n = len - bytes_read; ++ /* getrandom() on Linux always succeeds and is never ++ * interrupted by a signal when requesting <= 256 bytes. ++ */ ++ ssize_t rv = getrandom(buf + bytes_read, n > 256 ? 256 : n, 0); ++ if (rv <= 0) ++ continue; /* Just retry. */ ++ ++ bytes_read += rv; ++ if (bytes_read == len) ++ return; ++ } ++ break; + #else + /* Shouldn't be possible to be here */ + break; +diff --git a/src/lib/setup_once.h b/src/lib/setup_once.h +index a8cfe6bec..4b0f9cec2 100644 +--- a/src/lib/setup_once.h ++++ b/src/lib/setup_once.h +@@ -91,6 +91,10 @@ + # endif + #endif + ++#ifdef HAVE_SYS_RANDOM_H ++#include ++#endif ++ + #ifdef HAVE_SYS_SOCKET_H + #include + #endif diff --git a/backport-003-CVE-2023-31147.patch b/backport-003-CVE-2023-31147.patch new file mode 100644 index 0000000..07e1ce4 --- /dev/null +++ b/backport-003-CVE-2023-31147.patch @@ -0,0 +1,32 @@ +From 00f47ed830fc22775ffdc2bc2a691372684fae4f Mon Sep 17 00:00:00 2001 +From: bradh352 +Date: Mon, 22 May 2023 07:02:59 -0400 +Subject: [PATCH] ares_rand static analysis fixes from CI + +Conflict: NA +Reference: https://github.com/c-ares/c-ares/commit/00f47ed830fc22775ffdc2bc2a691372684fae4f +--- + src/lib/ares_rand.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/src/lib/ares_rand.c b/src/lib/ares_rand.c +index a564bc23..a55a90bf 100644 +--- a/src/lib/ares_rand.c ++++ b/src/lib/ares_rand.c +@@ -125,7 +125,7 @@ static void ares_rc4_init(ares_rand_rc4 *rc4_state) + } + + /* Just outputs the key schedule, no need to XOR with any data since we have none */ +-static void ares_rc4_prng(ares_rand_rc4 *rc4_state, unsigned char *buf, int len) ++static void ares_rc4_prng(ares_rand_rc4 *rc4_state, unsigned char *buf, size_t len) + { + unsigned char *S = rc4_state->S; + size_t i = rc4_state->i; +@@ -225,7 +225,6 @@ static void ares__rand_bytes(ares_rand_state *state, unsigned char *buf, size_t + { + + while (1) { +- size_t rv; + size_t bytes_read = 0; + + switch (state->type) { diff --git a/backport-004-CVE-2023-31147.patch b/backport-004-CVE-2023-31147.patch new file mode 100644 index 0000000..ecc98ff --- /dev/null +++ b/backport-004-CVE-2023-31147.patch @@ -0,0 +1,33 @@ +From 7da53555c284e896baabdaef441e883bf5245f11 Mon Sep 17 00:00:00 2001 +From: bradh352 +Date: Mon, 22 May 2023 07:37:38 -0400 +Subject: [PATCH] windows MSVC compiler fix on 32bit + +Conflict: NA +Reference: https://github.com/c-ares/c-ares/commit/7da53555c284e896baabdaef441e883bf5245f11 +--- + src/lib/ares_rand.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/src/lib/ares_rand.c b/src/lib/ares_rand.c +index a55a90bf..766c1e6e 100644 +--- a/src/lib/ares_rand.c ++++ b/src/lib/ares_rand.c +@@ -58,10 +58,16 @@ BOOLEAN WINAPI SystemFunction036(PVOID RandomBuffer, ULONG RandomBufferLength); + + #define ARES_RC4_KEY_LEN 32 /* 256 bits */ + ++#ifdef _MSC_VER ++typedef unsigned __int64 cares_u64; ++#else ++typedef unsigned long long cares_u64; ++#endif ++ + static unsigned int ares_u32_from_ptr(void *addr) + { + if (sizeof(void *) == 8) { +- return (unsigned int)((((size_t)addr >> 32) & 0xFFFFFFFF) | ((size_t)addr & 0xFFFFFFFF)); ++ return (unsigned int)((((cares_u64)addr >> 32) & 0xFFFFFFFF) | ((cares_u64)addr & 0xFFFFFFFF)); + } + return (unsigned int)((size_t)addr & 0xFFFFFFFF); + } diff --git a/backport-005-CVE-2023-31147.patch b/backport-005-CVE-2023-31147.patch new file mode 100644 index 0000000..7ab1b68 --- /dev/null +++ b/backport-005-CVE-2023-31147.patch @@ -0,0 +1,36 @@ +From 6360e96b5cf8e5980c887ce58ef727e53d77243a Mon Sep 17 00:00:00 2001 +From: bradh352 +Date: Mon, 22 May 2023 08:01:38 -0400 +Subject: [PATCH] Makefile.inc Windows requires tabs not spaces for nmake + +Conflict: NA +Reference: https://github.com/c-ares/c-ares/commit/6360e96b5cf8e5980c887ce58ef727e53d77243a +--- + src/lib/Makefile.inc | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/lib/Makefile.inc b/src/lib/Makefile.inc +index 49bbe60..02d8d58 100644 +--- a/src/lib/Makefile.inc ++++ b/src/lib/Makefile.inc +@@ -45,7 +45,7 @@ CSOURCES = ares__addrinfo2hostent.c \ + ares_platform.c \ + ares_process.c \ + ares_query.c \ +- ares_rand.c \ ++ ares_rand.c \ + ares_search.c \ + ares_send.c \ + ares_strcasecmp.c \ +@@ -60,7 +60,7 @@ CSOURCES = ares__addrinfo2hostent.c \ + inet_ntop.c \ + windows_port.c + +-HHEADERS = ares_android.h \ ++HHEADERS = ares_android.h \ + ares_data.h \ + ares_getenv.h \ + ares_inet_net_pton.h \ +-- +2.33.0 + diff --git a/backport-CVE-2023-31124.patch b/backport-CVE-2023-31124.patch new file mode 100644 index 0000000..3443128 --- /dev/null +++ b/backport-CVE-2023-31124.patch @@ -0,0 +1,71 @@ +From c4930223e51d0e3dbfd8b2a814f4be2e269e2a9d Mon Sep 17 00:00:00 2001 +From: Brad House +Date: Sun, 30 Apr 2023 14:53:34 -0400 +Subject: [PATCH] Merge pull request from GHSA-54xr-f67r-4pc4 + +* CARES_RANDOM_FILE should always default to /dev/urandom + +During cross-compilation, CARES_RANDOM_FILE may not be able to be appropriately +detected, therefore we should always set it to /dev/urandom and allow the +entity requesting compilation override the value. The code does appropriately +fall back if CARES_RANDOM_FILE cannot be opened. + +* use set not option + +Conflict: NA +Reference: https://github.com/c-ares/c-ares/commit/c4930223e51d0e3dbfd8b2a814f4be2e269e2a9d +--- + CMakeLists.txt | 6 ++---- + configure.ac | 12 +----------- + 2 files changed, 3 insertions(+), 15 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 7a29fef..0ec8d41 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -36,6 +36,8 @@ OPTION (CARES_STATIC_PIC "Build the static library as PIC (position independent) + OPTION (CARES_BUILD_TESTS "Build and run tests" OFF) + OPTION (CARES_BUILD_CONTAINER_TESTS "Build and run container tests (implies CARES_BUILD_TESTS, Linux only)" OFF) + OPTION (CARES_BUILD_TOOLS "Build tools" ON) ++SET (CARES_RANDOM_FILE "/dev/urandom" CACHE STRING "Suitable File / Device Path for entropy, such as /dev/urandom") ++ + + # Tests require static to be enabled on Windows to be able to access otherwise hidden symbols + IF (CARES_BUILD_TESTS AND (NOT CARES_STATIC) AND WIN32) +@@ -402,10 +404,6 @@ SET (CMAKE_REQUIRED_DEFINITIONS) + SET (CMAKE_REQUIRED_LIBRARIES) + + +-find_file(CARES_RANDOM_FILE urandom /dev) +-mark_as_advanced(CARES_RANDOM_FILE) +- +- + ################################################################################ + # recv, recvfrom, send, getnameinfo, gethostname + # ARGUMENTS AND RETURN VALUES +diff --git a/configure.ac b/configure.ac +index 56a570b..f8ebd07 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -896,17 +896,7 @@ AC_ARG_WITH(random, + AS_HELP_STRING([--with-random=FILE], + [read randomness from FILE (default=/dev/urandom)]), + [ CARES_RANDOM_FILE="$withval" ], +- [ +- dnl Check for random device. If we're cross compiling, we can't +- dnl check, and it's better to assume it doesn't exist than it is +- dnl to fail on AC_CHECK_FILE or later. +- if test "$cross_compiling" = "no"; then +- AC_CHECK_FILE("/dev/urandom", [ CARES_RANDOM_FILE="/dev/urandom"] ) +- else +- AC_MSG_WARN([cannot check for /dev/urandom while cross compiling; assuming none]) +- fi +- +- ] ++ [ CARES_RANDOM_FILE="/dev/urandom" ] + ) + if test -n "$CARES_RANDOM_FILE" && test X"$CARES_RANDOM_FILE" != Xno ; then + AC_SUBST(CARES_RANDOM_FILE) +-- +2.33.0 + diff --git a/c-ares.spec b/c-ares.spec index b6512a4..8c9cc80 100644 --- a/c-ares.spec +++ b/c-ares.spec @@ -1,6 +1,6 @@ Name: c-ares Version: 1.18.1 -Release: 6 +Release: 7 Summary: A C library for asynchronous DNS requests License: MIT @@ -16,6 +16,12 @@ Patch3: backport-CVE-2023-32067.patch Patch4: backport-001-CVE-2023-31130.patch Patch5: backport-002-CVE-2023-31130.patch Patch6: backport-003-CVE-2023-31130.patch +Patch7: backport-001-CVE-2023-31147.patch +Patch8: backport-002-CVE-2023-31124_CVE-2023-31147.patch +Patch9: backport-003-CVE-2023-31147.patch +Patch10: backport-004-CVE-2023-31147.patch +Patch11: backport-005-CVE-2023-31147.patch +Patch12: backport-CVE-2023-31124.patch %description This is c-ares, an asynchronous resolver library. It is intended for applications @@ -62,6 +68,12 @@ make %{?_smp_mflags} %{_mandir}/man3/* %changelog +* Mon May 29 2023 xinghe - 1.18.1-7 +- Type:CVE +- CVE:CVE-2023-31124 CVE-2023-31147 +- SUG:NA +- DESC:fix CVE-2023-31124 CVE-2023-31147 + * Sun May 28 2023 hehuazhen - 1.18.1-6 - Type:CVE - CVE:CVE-2023-32067 CVE-2023-31130 -- Gitee