CVE-2021-3672
Medium
Description
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.
SeverityMedium
CVSS5.6
Exploit probability—
Product
C-ares
PublishedNov 23, 2021
First seenNov 23, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- c-ares_project c-ares1.17.2 or later
- siemens sinec_infrastructure_network_services1.0.1.1 or later
- nodejs node.js12.22.5, 14.17.5, 16.6.2 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| c-ares_project c-ares | 1.0.0 ≤ v < 1.17.2 | 1.17.2 |
| fedoraproject fedora | 33, 34 | — |
| redhat enterprise_linux | 7.0, 7.7, 8.0 | — |
| redhat enterprise_linux_computer_node | 1 | — |
| redhat enterprise_linux_eus | 7.7, 8.1, 8.2, 8.4 | — |
| redhat enterprise_linux_for_ibm_z_systems | 8.0 | — |
| redhat enterprise_linux_for_ibm_z_systems_eus | 8.1, 8.2, 8.4 | — |
| redhat enterprise_linux_for_power_little_endian | 8.0 | — |
| redhat enterprise_linux_for_power_little_endian_eus | 8.1, 8.2, 8.4 | — |
| redhat enterprise_linux_server_aus | 8.2, 8.4 | — |
| redhat enterprise_linux_server_tus | 8.2, 8.4 | — |
| redhat enterprise_linux_server_update_services_for_sap_solutions | 8.1, 8.2, 8.4 | — |
| redhat enterprise_linux_tus | 8.4 | — |
| redhat enterprise_linux_workstation | 1 | — |
| siemens sinec_infrastructure_network_services | v < 1.0.1.1 | 1.0.1.1 |
| nodejs node.js | 12.0.0 ≤ v ≤ 12.12.0, 12.13.0 ≤ v < 12.22.5, 14.0.0 ≤ v ≤ 14.14.0, 14.15.0 ≤ v < 14.17.5, 16.0.0 ≤ v < 16.6.2 | 12.22.5, 14.17.5, 16.6.2 |
| pgbouncer pgbouncer | v ≤ 1.17.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.