Input Validation Flaw in c-ares Library Affects Networking Software from Various Vendors
CVE-2021-3672

5.6MEDIUM

Key Information:

Vendor

C-ares Project

Status
C-ares
Vendor
CVE Published:
23 November 2021

What is CVE-2021-3672?

A flaw in the c-ares library allows for insufficient validation of host names from DNS responses, which can lead to incorrect host names being output. This poses a risk of Domain Hijacking, potentially compromising the confidentiality and integrity of data, while also affecting system availability. The vulnerability underscores the necessity for robust input validation mechanisms in software relying on DNS services.

Affected Version(s)

c-ares c-ares 1.17.2

References

https://bugzilla.redhat.com/show_bug.cgi?id=1988342
https://c-ares.haxx.se/adv_20210810.html
https://cert-portal.siemens.com/productcert/pdf/ssa-38929...

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.