HCE2-SA-2023-0242 Moderate HCE 2.0 Security Fix(es): c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124) c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1. (CVE-2023-31147) HCE 2.0 c-ares-1.18.1-1.r4.hce2.aarch64.rpm c-ares-devel-1.18.1-1.r4.hce2.aarch64.rpm c-ares-help-1.18.1-1.r4.hce2.noarch.rpm c-ares-1.18.1-1.r4.hce2.x86_64.rpm c-ares-devel-1.18.1-1.r4.hce2.x86_64.rpm