CVE Feed

    Dashboard / CVE / CVE-2021-3672

    CVE-2021-3672

    A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

    Published:Aug 10, 2021
    Last Modified:Nov 21, 2024
    EPS:Nov 23, 2021
    EPSS Score:0.00113
    CVSS Score:5.6

    Affected Products

    Vendor
    C-ares Project
    Product
    C-ares
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Nodejs
    Product
    Node.js
    Vendor
    Pgbouncer
    Product
    Pgbouncer
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Enterprise Linux Computer Node
    Vendor
    Redhat
    Product
    Enterprise Linux Eus
    Vendor
    Redhat
    Product
    Enterprise Linux For Ibm Z Systems
    Vendor
    Redhat
    Product
    Enterprise Linux For Ibm Z Systems Eus
    Vendor
    Redhat
    Product
    Enterprise Linux For Power Little Endian
    Vendor
    Redhat
    Product
    Enterprise Linux For Power Little Endian Eus
    Vendor
    Redhat
    Product
    Enterprise Linux Server Aus
    Vendor
    Redhat
    Product
    Enterprise Linux Server Tus
    Vendor
    Redhat
    Product
    Enterprise Linux Server Update Services For Sap Solutions
    Vendor
    Redhat
    Product
    Enterprise Linux Tus
    Vendor
    Redhat
    Product
    Enterprise Linux Workstation
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhel Software Collections
    Vendor
    Siemens
    Product
    Sinec Infrastructure Network Services

    Exploits

    https://c-ares.haxx.se/adv_20210810.htmlhttps://c-ares.haxx.se/adv_20210810.html

    Related CVEs

    CVE-2023-31147 (CVSS 5.9) — c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses r…
    CVE-2023-31124 (CVSS 3.7) — c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, …
    CVE-2023-32067 (CVSS 7.5) — c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver se…
    CVE-2023-31130 (CVSS 4.1) — c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certa…
    CVE-2022-4904 (CVSS 8.6) — A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the inpu…
    CVE-2020-8277 (CVSS 7.5) — A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigge…
    CVE-2017-1000381 (CVSS 7.5) — The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered …
    CVE-2016-5180 (CVSS 9.8) — Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attacke…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High