CVE-2023-31124: 
npm vulnerability analysis and mitigation

CVE-2023-31124 affects c-ares, an asynchronous resolver library. The vulnerability was discovered in versions prior to 1.19.1 and disclosed on May 22, 2023. The issue occurs when cross-compiling c-ares using the autotools build system, specifically when cross-compiling for aarch64 android, where CARES_RANDOM_FILE is not set (GitHub Advisory).

The vulnerability stems from a build system configuration issue where CARES_RANDOM_FILE is not properly set during cross-compilation. This results in the system falling back to using rand() instead of a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). The vulnerability has been assigned a CVSS v3.1 base score of 3.7 LOW, with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. The weakness has been categorized as CWE-330 (Use of Insufficiently Random Values) (GitHub Advisory).

The vulnerability could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG, potentially compromising the security of DNS operations when the library is cross-compiled (GitHub Advisory).

The vulnerability requires high attack complexity and can be exploited remotely without requiring privileges or user interaction. The scope is unchanged, with no impact on confidentiality, low impact on integrity, and no impact on availability (GitHub Advisory).

The vulnerability has been patched in c-ares version 1.19.1. As a workaround, users can use the CMake build system instead of autotools. Various distributions have released security updates, including Fedora 37 and 38, and Gentoo (Fedora Update, Gentoo Advisory).

The vulnerability was discovered during a security audit of c-ares performed by X41 D-SEC GmbH, which was funded by the Open Source Technology Improvement Fund (OSTIF). The audit findings led to prompt security patches and updates across multiple distributions (GitHub Release).