CVE-2021-3672

MEDIUM

c-ares 1.0.0-1.17.1 - Domain Hijacking via DNS Hostname Validation Bypass

Title source: llm
STIX 2.1

Description

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

References (5)

Core 5
Core References
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202401-02
Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1988342
Exploit, Patch, Vendor Advisory
https://c-ares.haxx.se/adv_20210810.html

Scores

CVSS v3 5.6
EPSS 0.0004
EPSS Percentile 13.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (32)
c-ares_project/c-ares 1.0.0 - 1.17.2
fedoraproject/fedora 33
fedoraproject/fedora 34
nodejs/node.js 12.0.0 - 12.12.0
nodejs/node.js 12.13.0 - 12.22.5
pgbouncer/pgbouncer < 1.17.0
redhat/enterprise_linux 7.0
redhat/enterprise_linux 7.7
redhat/enterprise_linux 8.0
redhat/enterprise_linux_computer_node 1
... and 22 more
Published Nov 23, 2021
Tracked Since Feb 18, 2026