CVE-2022-4904

Publication date 15 February 2023

Last updated 18 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

8.6 · High

Score breakdown

Description

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Status

Package Ubuntu Release Status
c-ares 25.10 questing
Not affected
25.04 plucky
Not affected
24.10 oracular
Not affected
24.04 LTS noble
Not affected
23.10 mantic
Not affected
23.04 lunar
Not affected
22.10 kinetic
Fixed 1.18.1-1ubuntu0.22.10.1
22.04 LTS jammy
Fixed 1.18.1-1ubuntu0.22.04.1
20.04 LTS focal
Fixed 1.15.0-1ubuntu0.2
18.04 LTS bionic
Fixed 1.14.0-1ubuntu0.2
16.04 LTS xenial
Needs evaluation
14.04 LTS trusty Ignored end of standard support

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
c-ares

Severity score breakdown

Parameter Value
Base score 8.6 · High
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References

Related Ubuntu Security Notices (USN)

Other references