p PatchFirst

CVE-2021-3672

CVE-2021-3672

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

CVSS 5.6 · Medium · EPSS 2.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • c-ares

    Versions
    • c-ares 1.17.2: Affected

    No fix published

  • c-ares Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.17.1-1.1

    Update to 1.17.1-1.1

  • c-ares Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.17.1-1.1

    Update to 1.17.1-1.1

  • c-ares Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.17.1-1.1

    Update to 1.17.1-1.1

  • c-ares Ubuntu:Pro:16.04:LTS

    Versions
    • 1.10.0-2
    • 1.10.0-3
    • 1.10.0-3ubuntu0.1
    • 1.10.0-3ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 1.10.0-3ubuntu0.2+esm1

    Update to 1.10.0-3ubuntu0.2+esm1

  • c-ares Ubuntu:18.04:LTS

    Versions
    • 1.13.0-2
    • 1.13.0-3
    • 1.14.0-1
    Affected ranges
    • ECOSYSTEM: < 1.14.0-1ubuntu0.1

    Update to 1.14.0-1ubuntu0.1

  • c-ares Ubuntu:20.04:LTS

    Versions
    • 1.15.0-1build1
    Affected ranges
    • ECOSYSTEM: < 1.15.0-1ubuntu0.1

    Update to 1.15.0-1ubuntu0.1

  • c-ares Ubuntu:22.04:LTS

    Affected ranges
    • ECOSYSTEM: < 1.17.1-1ubuntu1

    Update to 1.17.1-1ubuntu1

Original sources

Check your server →