Upstream update available: c-ares 1.34.6 → 1.34.7 #4

Open
opened 2026-07-07 02:07:24 +03:00 by sbelikov · 0 comments
Owner

Upstream update available: c-ares 1.34.61.34.7

Package

  • Package: c-ares
  • RPM name: c-ares
  • Branch: niceos-5.2
  • Current EVR: 1.34.6-1
  • Update class: patch
  • Compare method: python_rpm
  • Update policy: leaf
  • Risk tags: github-upstream

Upstream

Signals

  • Security-relevant keywords detected: True
  • Policy blocked: False
  • Policy reason: -
  • Labels: ai-summary, bot, needs-build, needs-triage, priority/high, security-release, update/patch, upstream-update, upstream/github

NiceSOFT AI preliminary stability analysis

The upstream update for c-ares (version 1.34.7) introduces security fixes and improvements to address potential vulnerabilities. Below is a structured analysis of the key points:


1. Security Highlights

  • Critical Fixes:

    • Integer Overflows: Addresses potential issues in allocation and buffer handling (PRs #1116, #1117, #1147).
    • Buffer Overflows: Fixes in DNS record handling (PR #1168) to prevent memory corruption.
    • Other Vulnerabilities: Updates to prevent integer overflow in critical functions (PRs #1117, #1147).
  • Impact:
    These patches are critical for systems using c-ares to prevent buffer overflow and integer overflow vulnerabilities that could lead to code execution or data corruption.


2. Release Context

  • Version: 1.34.7 (from GitHub tag v1.34.7).
  • Release Date: July 6, 2026 (based on the OpenShift CI tag 5.0.0-0.ci-2026-07-06-214840).
  • Dependencies:
    • The update is part of the NAS.OS ecosystem, likely for DNS resolution in asynchronous applications.
    • The release is officially documented on the c-ares website and GitHub.

3. Recommendations

  • Apply the Update:

    • Update NAS.OS to ensure compatibility with the new version.
    • Verify that the update aligns with your system's codebase (e.g., check for PRs #1116–#1168).
  • Review Changelog:

    • The changelog details specific fixes, which are essential for understanding the scope of the update.
  • Security Considerations:

    • Ensure the update is applied before deploying to critical systems (e.g., cloud services, IoT devices).
    • Monitor for potential conflicts with existing code (e.g., if the NAS.OS codebase is modified in the interim).

4. Risks and Mitigations

  • Risk:

    • Inadequate patches could leave systems vulnerable to buffer overflow or integer overflow attacks.
  • Mitigation:

    • Apply the update promptly.
    • Validate the patches against your system's codebase (e.g., check for PRs #1116–#1168).
    • Consider code audits or dependency checks to confirm compatibility.

5. Conclusion

The c-ares 1.34.7 release is a critical security update that addresses buffer and integer overflow vulnerabilities. It is essential for NAS.OS systems using c-ares to ensure secure and stable DNS resolution. The update should be applied promptly and verified against the system's codebase to avoid potential risks.

Action Steps:

  1. Apply the update via NAS.OS upgrade.
  2. Review the changelog for specific fixes.
  3. Validate compatibility with existing code.
  4. Monitor for any conflicts or issues post-upgrade.

This update is mandatory for security compliance and should be prioritized in the deployment timeline.

  1. GitHub release API: c-ares/c-ares v1.34.7
  2. GitHub tag page: c-ares/c-ares v1.34.7
  3. GitHub releases page: c-ares/c-ares
  4. GitHub compare page: c-ares/c-ares v1.34.6...v1.34.7
  5. C (programming language) - Wikipedia
  6. CodeWithHarry/The-Ultimate-C-Programming-Course - GitHub
  7. Changelog - c-ares: a modern asynchronous DNS resolver
  8. GitHub Star History — Track & Compare Open Source Star Growth
  9. Release 5.0.0-0.ci-2026-07-06-214840

Upstream release notes / description

c-ares version 1.34.7 - July 6 2026

This is a security release.

Security:

Changes:

  • ares_getaddrinfo(): handle a NULL node per POSIX and implement
    ARES_AI_PASSIVE. PR #1186
  • Mark parameters in callbacks as const.
    PR #1060
  • Correct ARES_CLASS_HESOID misspelling to ARES_CLASS_HESIOD.
    PR #1092

Bugfixes:

  • Fix sticky server recovery when all servers have failures. PR #1192
  • Fix UDP socket exhaustion regression: retire connections per-connection, not via server failure count. PR #1197
  • Guard DNS record binary length overflow. PR #1168
  • Prevent integer overflow in allocation size calculations. PR #1147
  • Prevent overflow in ares_array allocation size calculations. PR #1117
  • Prevent integer overflow in buffer size calculation. PR #1116
  • Add overflow checks to ares_buf_ensure_space(). PR #1094
  • Skip name compression offsets beyond the 14-bit pointer limit. PR #1159
  • ares_dns_parse: reject name compression in RDATA where not permitted (RFC 3597). PR #1190
  • ares_dns_parse: reject responses with more than one OPT record (RFC 6891). PR #1189
  • Discard oversized UDP datagrams instead of truncating the length frame. PR #1161
  • Route numeric config parsing through range-checked ares_str_parse_uint. PR #1158
  • Replace atoi-based port parsing with validated helper. PR #1097
  • Defer TCP connection error handling until DNS responses are parsed. PR #1138
  • Prevent undefined-behavior left shift in ares_calc_query_timeout(). PR #1151
  • Use unsigned type for ares_round_up_pow2_u64 to avoid undefined behavior. PR #1107
  • Fix undefined behavior in ares_buf_replace() pointer arithmetic. PR #1099
  • ares_array: reset offset when array becomes empty. PR #1165
  • ares_iface_ips: add ARES_IFACE_IP_NONE zero enum value. PR #1187
  • ares_sysconfig_files: recognize AIX netsvc.conf bind4/local4 tokens. PR #1188
  • Use safe string construction in Windows sysconfig join path. PR #1143
  • Fix zero-length RAW_RR losing type metadata during parsing. PR #1129
  • Fix RAW_RR type tostr/fromstr roundtrip mismatch. PR #1123
  • Fix NULL dereference for ifa netmask. PR #1120
  • adig: fix negated option prefix parsing. PR #1135
  • Use UnregisterWaitEx to prevent use-after-free on Win32. PR #1111
  • Add NULL check after ares_malloc_zero in Windows UTF8 conversion. PR #1121
  • Fix NULL dereference after ares_malloc_zero in Win32 IOCP event add. PR #1132
  • Fix microsecond overflow in ares_queue_wait_empty timeout. PR #1122
  • Fix NULL dereference in ares_buf_replace() on NULL buf. PR #1124
  • Initialize *read_bytes in ares_socket_recvfrom(). PR #1125
  • Fix memory leak of binbuf in ares_buf_parse_dns_binstr_int. PR #1126
  • Fix memory leak of qcache entry on key allocation failure. PR #1127
  • Fix memory leak of buf in ares_dns_multistring_combined() on OOM. PR #1110
  • Fix memory leaks on error paths in two functions. PR #1109
  • Fix memory leak of buckets in ares_htable_dict_keys() error path. PR #1108
  • Fix memory leak of bucket->key in ares_htable_dict_insert error path. PR #1105
  • Fix additional memory leaks. PR #1091 PR #1078
  • Prevent corrupt addrinfo nodes on sockaddr allocation failure. PR #1112
  • Fix two logic bugs in DNS cookie handling. PR #1103
  • Fix linked list INSERT_BEFORE corruption and array insertdata_first ordering. PR #1101
  • Fix HASH_IDX macro mis

...[truncated 2628 chars]

NiceOS maintainer checklist

  • Confirm that the detected version is a stable upstream release.
  • Check upstream changelog for security fixes, ABI/API changes and build-system changes.
  • Check ABI/API compatibility and reverse dependencies.
  • Download source into NiceOS lookaside storage.
  • Update Version and related fields in SPECS/*.spec only if policy allows it.
  • Regenerate SOURCES/sources.lock.json, manifests, metadata and SBOM.
  • Build SRPM/RPM in a clean NiceOS buildroot.
  • Run package smoke tests.
  • Link PR/build logs and close this issue after update or triage.

Bot metadata

  • Tool: niceos_upstream_monitor.py 2.1.3-local-websearch-github-release-pages
  • Generated at: 2026-07-06T23:07:22Z
<!-- niceos-upstream-monitor:fingerprint=upstream-update:c-ares:1.34.7 --> <!-- niceos-upstream-monitor:package=c-ares --> <!-- niceos-upstream-monitor:current=1.34.6 --> <!-- niceos-upstream-monitor:latest=1.34.7 --> # Upstream update available: `c-ares` `1.34.6` → `1.34.7` ## Package - Package: `c-ares` - RPM name: `c-ares` - Branch: `niceos-5.2` - Current EVR: `1.34.6-1` - Update class: `patch` - Compare method: `python_rpm` - Update policy: `leaf` - Risk tags: `github-upstream` ## Upstream - Upstream type: `github` - Upstream project: `c-ares/c-ares` - Upstream URL: <a href="https://github.com/c-ares/c-ares" target="_blank" rel="noopener noreferrer">github.com — c ares</a> - Detected version: `1.34.7` - Tag/release: `v1.34.7` - Source: `github_release_latest` - Published: `2026-07-06T17:35:39Z` - Release URL: <a href="https://github.com/c-ares/c-ares/releases/tag/v1.34.7" target="_blank" rel="noopener noreferrer">github.com — v1.34.7</a> - Source URL: <a href="https://api.github.com/repos/c-ares/c-ares/tarball/v1.34.7" target="_blank" rel="noopener noreferrer">api.github.com — v1.34.7</a> - Pre-release: `False` ## Signals - Security-relevant keywords detected: `True` - Policy blocked: `False` - Policy reason: `-` - Labels: `ai-summary, bot, needs-build, needs-triage, priority/high, security-release, update/patch, upstream-update, upstream/github` ## NiceSOFT AI preliminary stability analysis The upstream update for **c-ares (version 1.34.7)** introduces **security fixes** and **improvements** to address potential vulnerabilities. Below is a structured analysis of the key points: --- ### **1. Security Highlights** - **Critical Fixes**: - **Integer Overflows**: Addresses potential issues in allocation and buffer handling (PRs #1116, #1117, #1147). - **Buffer Overflows**: Fixes in DNS record handling (PR #1168) to prevent memory corruption. - **Other Vulnerabilities**: Updates to prevent integer overflow in critical functions (PRs #1117, #1147). - **Impact**: These patches are **critical for systems using c-ares** to prevent **buffer overflow and integer overflow vulnerabilities** that could lead to **code execution or data corruption**. --- ### **2. Release Context** - **Version**: 1.34.7 (from GitHub tag `v1.34.7`). - **Release Date**: July 6, 2026 (based on the OpenShift CI tag `5.0.0-0.ci-2026-07-06-214840`). - **Dependencies**: - The update is part of the **NAS.OS** ecosystem, likely for **DNS resolution** in asynchronous applications. - The release is **officially documented** on the <a href="https://c-ares.org/changelog.html" target="_blank" rel="noopener noreferrer">c-ares website</a> and GitHub. --- ### **3. Recommendations** - **Apply the Update**: - **Update NAS.OS** to ensure compatibility with the new version. - Verify that the update aligns with your system's codebase (e.g., check for PRs #1116–#1168). - **Review Changelog**: - The <a href="https://c-ares.org/changelog.html" target="_blank" rel="noopener noreferrer">changelog</a> details specific fixes, which are essential for understanding the scope of the update. - **Security Considerations**: - Ensure the update is applied **before deploying** to critical systems (e.g., cloud services, IoT devices). - Monitor for **potential conflicts** with existing code (e.g., if the NAS.OS codebase is modified in the interim). --- ### **4. Risks and Mitigations** - **Risk**: - Inadequate patches could leave systems vulnerable to **buffer overflow or integer overflow attacks**. - **Mitigation**: - Apply the update promptly. - Validate the patches against your system's codebase (e.g., check for PRs #1116–#1168). - Consider **code audits** or **dependency checks** to confirm compatibility. --- ### **5. Conclusion** The **c-ares 1.34.7 release** is a **critical security update** that addresses **buffer and integer overflow vulnerabilities**. It is essential for **NAS.OS** systems using c-ares to ensure **secure and stable DNS resolution**. The update should be applied **promptly** and verified against the system's codebase to avoid potential risks. **Action Steps**: 1. Apply the update via NAS.OS upgrade. 2. Review the changelog for specific fixes. 3. Validate compatibility with existing code. 4. Monitor for any conflicts or issues post-upgrade. This update is **mandatory** for security compliance and should be prioritized in the deployment timeline. ### Источники, найденные web_search 1. <a href="https://github.com/c-ares/c-ares/releases/tag/v1.34.7" target="_blank" rel="noopener noreferrer">GitHub release API: c-ares/c-ares v1.34.7</a> 2. <a href="https://github.com/c-ares/c-ares/tree/v1.34.7" target="_blank" rel="noopener noreferrer">GitHub tag page: c-ares/c-ares v1.34.7</a> 3. <a href="https://github.com/c-ares/c-ares/releases" target="_blank" rel="noopener noreferrer">GitHub releases page: c-ares/c-ares</a> 4. <a href="https://github.com/c-ares/c-ares/compare/v1.34.6...v1.34.7" target="_blank" rel="noopener noreferrer">GitHub compare page: c-ares/c-ares v1.34.6...v1.34.7</a> 5. <a href="https://en.wikipedia.org/wiki/C_(programming_language)" target="_blank" rel="noopener noreferrer">C (programming language) - Wikipedia</a> 6. <a href="https://github.com/CodeWithHarry/The-Ultimate-C-Programming-Course" target="_blank" rel="noopener noreferrer">CodeWithHarry/The-Ultimate-C-Programming-Course - GitHub</a> 7. <a href="https://c-ares.org/changelog.html" target="_blank" rel="noopener noreferrer">Changelog - c-ares: a modern asynchronous DNS resolver</a> 8. <a href="https://www.star-history.com/" target="_blank" rel="noopener noreferrer">GitHub Star History — Track &amp; Compare Open Source Star Growth</a> 9. <a href="https://openshift-release.apps.ci.l2s4.p1.openshiftapps.com/releasetag/5.0.0-0.ci-2026-07-06-214840" target="_blank" rel="noopener noreferrer">Release 5.0.0-0.ci-2026-07-06-214840</a> ## Upstream release notes / description ## c-ares version 1.34.7 - July 6 2026 This is a security release. Security: * CVE-2026-33630. Use-after-free / double-free in c-ares' query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP. Please see <a href="https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542" target="_blank" rel="noopener noreferrer">github.com — GHSA 6wfj rwm7 3542</a> * CPU-exhaustion denial of service via unbounded DNS name compression pointer chains. Please see <a href="https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76" target="_blank" rel="noopener noreferrer">github.com — GHSA pjmc gx33 gc76</a> * Memory-amplification denial of service via unvalidated DNS header record counts. Please see <a href="https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj" target="_blank" rel="noopener noreferrer">github.com — GHSA jv8r gqr9 68wj</a> Changes: * `ares_getaddrinfo()`: handle a NULL node per POSIX and implement `ARES_AI_PASSIVE`. <a href="https://github.com/c-ares/c-ares/pull/1186" target="_blank" rel="noopener noreferrer">PR #1186</a> * Mark parameters in callbacks as const. <a href="https://github.com/c-ares/c-ares/pull/1060" target="_blank" rel="noopener noreferrer">PR #1060</a> * Correct `ARES_CLASS_HESOID` misspelling to `ARES_CLASS_HESIOD`. <a href="https://github.com/c-ares/c-ares/pull/1092" target="_blank" rel="noopener noreferrer">PR #1092</a> Bugfixes: * Fix sticky server recovery when all servers have failures. <a href="https://github.com/c-ares/c-ares/pull/1192" target="_blank" rel="noopener noreferrer">PR #1192</a> * Fix UDP socket exhaustion regression: retire connections per-connection, not via server failure count. <a href="https://github.com/c-ares/c-ares/pull/1197" target="_blank" rel="noopener noreferrer">PR #1197</a> * Guard DNS record binary length overflow. <a href="https://github.com/c-ares/c-ares/pull/1168" target="_blank" rel="noopener noreferrer">PR #1168</a> * Prevent integer overflow in allocation size calculations. <a href="https://github.com/c-ares/c-ares/pull/1147" target="_blank" rel="noopener noreferrer">PR #1147</a> * Prevent overflow in ares_array allocation size calculations. <a href="https://github.com/c-ares/c-ares/pull/1117" target="_blank" rel="noopener noreferrer">PR #1117</a> * Prevent integer overflow in buffer size calculation. <a href="https://github.com/c-ares/c-ares/pull/1116" target="_blank" rel="noopener noreferrer">PR #1116</a> * Add overflow checks to ares_buf_ensure_space(). <a href="https://github.com/c-ares/c-ares/pull/1094" target="_blank" rel="noopener noreferrer">PR #1094</a> * Skip name compression offsets beyond the 14-bit pointer limit. <a href="https://github.com/c-ares/c-ares/pull/1159" target="_blank" rel="noopener noreferrer">PR #1159</a> * ares_dns_parse: reject name compression in RDATA where not permitted (RFC 3597). <a href="https://github.com/c-ares/c-ares/pull/1190" target="_blank" rel="noopener noreferrer">PR #1190</a> * ares_dns_parse: reject responses with more than one OPT record (RFC 6891). <a href="https://github.com/c-ares/c-ares/pull/1189" target="_blank" rel="noopener noreferrer">PR #1189</a> * Discard oversized UDP datagrams instead of truncating the length frame. <a href="https://github.com/c-ares/c-ares/pull/1161" target="_blank" rel="noopener noreferrer">PR #1161</a> * Route numeric config parsing through range-checked ares_str_parse_uint. <a href="https://github.com/c-ares/c-ares/pull/1158" target="_blank" rel="noopener noreferrer">PR #1158</a> * Replace atoi-based port parsing with validated helper. <a href="https://github.com/c-ares/c-ares/pull/1097" target="_blank" rel="noopener noreferrer">PR #1097</a> * Defer TCP connection error handling until DNS responses are parsed. <a href="https://github.com/c-ares/c-ares/pull/1138" target="_blank" rel="noopener noreferrer">PR #1138</a> * Prevent undefined-behavior left shift in ares_calc_query_timeout(). <a href="https://github.com/c-ares/c-ares/pull/1151" target="_blank" rel="noopener noreferrer">PR #1151</a> * Use unsigned type for ares_round_up_pow2_u64 to avoid undefined behavior. <a href="https://github.com/c-ares/c-ares/pull/1107" target="_blank" rel="noopener noreferrer">PR #1107</a> * Fix undefined behavior in ares_buf_replace() pointer arithmetic. <a href="https://github.com/c-ares/c-ares/pull/1099" target="_blank" rel="noopener noreferrer">PR #1099</a> * ares_array: reset offset when array becomes empty. <a href="https://github.com/c-ares/c-ares/pull/1165" target="_blank" rel="noopener noreferrer">PR #1165</a> * ares_iface_ips: add ARES_IFACE_IP_NONE zero enum value. <a href="https://github.com/c-ares/c-ares/pull/1187" target="_blank" rel="noopener noreferrer">PR #1187</a> * ares_sysconfig_files: recognize AIX netsvc.conf bind4/local4 tokens. <a href="https://github.com/c-ares/c-ares/pull/1188" target="_blank" rel="noopener noreferrer">PR #1188</a> * Use safe string construction in Windows sysconfig join path. <a href="https://github.com/c-ares/c-ares/pull/1143" target="_blank" rel="noopener noreferrer">PR #1143</a> * Fix zero-length RAW_RR losing type metadata during parsing. <a href="https://github.com/c-ares/c-ares/pull/1129" target="_blank" rel="noopener noreferrer">PR #1129</a> * Fix RAW_RR type tostr/fromstr roundtrip mismatch. <a href="https://github.com/c-ares/c-ares/pull/1123" target="_blank" rel="noopener noreferrer">PR #1123</a> * Fix NULL dereference for ifa netmask. <a href="https://github.com/c-ares/c-ares/pull/1120" target="_blank" rel="noopener noreferrer">PR #1120</a> * adig: fix negated option prefix parsing. <a href="https://github.com/c-ares/c-ares/pull/1135" target="_blank" rel="noopener noreferrer">PR #1135</a> * Use UnregisterWaitEx to prevent use-after-free on Win32. <a href="https://github.com/c-ares/c-ares/pull/1111" target="_blank" rel="noopener noreferrer">PR #1111</a> * Add NULL check after ares_malloc_zero in Windows UTF8 conversion. <a href="https://github.com/c-ares/c-ares/pull/1121" target="_blank" rel="noopener noreferrer">PR #1121</a> * Fix NULL dereference after ares_malloc_zero in Win32 IOCP event add. <a href="https://github.com/c-ares/c-ares/pull/1132" target="_blank" rel="noopener noreferrer">PR #1132</a> * Fix microsecond overflow in ares_queue_wait_empty timeout. <a href="https://github.com/c-ares/c-ares/pull/1122" target="_blank" rel="noopener noreferrer">PR #1122</a> * Fix NULL dereference in ares_buf_replace() on NULL buf. <a href="https://github.com/c-ares/c-ares/pull/1124" target="_blank" rel="noopener noreferrer">PR #1124</a> * Initialize *read_bytes in ares_socket_recvfrom(). <a href="https://github.com/c-ares/c-ares/pull/1125" target="_blank" rel="noopener noreferrer">PR #1125</a> * Fix memory leak of binbuf in ares_buf_parse_dns_binstr_int. <a href="https://github.com/c-ares/c-ares/pull/1126" target="_blank" rel="noopener noreferrer">PR #1126</a> * Fix memory leak of qcache entry on key allocation failure. <a href="https://github.com/c-ares/c-ares/pull/1127" target="_blank" rel="noopener noreferrer">PR #1127</a> * Fix memory leak of buf in ares_dns_multistring_combined() on OOM. <a href="https://github.com/c-ares/c-ares/pull/1110" target="_blank" rel="noopener noreferrer">PR #1110</a> * Fix memory leaks on error paths in two functions. <a href="https://github.com/c-ares/c-ares/pull/1109" target="_blank" rel="noopener noreferrer">PR #1109</a> * Fix memory leak of buckets in ares_htable_dict_keys() error path. <a href="https://github.com/c-ares/c-ares/pull/1108" target="_blank" rel="noopener noreferrer">PR #1108</a> * Fix memory leak of bucket->key in ares_htable_dict_insert error path. <a href="https://github.com/c-ares/c-ares/pull/1105" target="_blank" rel="noopener noreferrer">PR #1105</a> * Fix additional memory leaks. <a href="https://github.com/c-ares/c-ares/pull/1091" target="_blank" rel="noopener noreferrer">PR #1091</a> <a href="https://github.com/c-ares/c-ares/pull/1078" target="_blank" rel="noopener noreferrer">PR #1078</a> * Prevent corrupt addrinfo nodes on sockaddr allocation failure. <a href="https://github.com/c-ares/c-ares/pull/1112" target="_blank" rel="noopener noreferrer">PR #1112</a> * Fix two logic bugs in DNS cookie handling. <a href="https://github.com/c-ares/c-ares/pull/1103" target="_blank" rel="noopener noreferrer">PR #1103</a> * Fix linked list INSERT_BEFORE corruption and array insertdata_first ordering. <a href="https://github.com/c-ares/c-ares/pull/1101" target="_blank" rel="noopener noreferrer">PR #1101</a> * Fix HASH_IDX macro mis ...[truncated 2628 chars] ## NiceOS maintainer checklist - [ ] Confirm that the detected version is a stable upstream release. - [ ] Check upstream changelog for security fixes, ABI/API changes and build-system changes. - [ ] Check ABI/API compatibility and reverse dependencies. - [ ] Download source into NiceOS lookaside storage. - [ ] Update `Version` and related fields in `SPECS/*.spec` only if policy allows it. - [ ] Regenerate `SOURCES/sources.lock.json`, manifests, metadata and SBOM. - [ ] Build SRPM/RPM in a clean NiceOS buildroot. - [ ] Run package smoke tests. - [ ] Link PR/build logs and close this issue after update or triage. ## Bot metadata - Tool: `niceos_upstream_monitor.py 2.1.3-local-websearch-github-release-pages` - Generated at: `2026-07-06T23:07:22Z`
Sign in to join this conversation.
No description provided.