CVE-2021-3672

State: Published
Severity: Not scored
Published: Nov 23, 2021
Updated: Oct 15, 2024
Reserved: Jul 30, 2021

Description

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Scores

The record has no CVSS score.

Weaknesses

CWE-79

Affected Products

Product	Versions
c-aresn/a	c-ares 1.17.2Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1988342
https://c-ares.haxx.se/adv_20210810.html
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
https://www.oracle.com/security-alerts/cpujul2022.html
GLSA-202401-02vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.