CVE-2021-3672 Other in c-ares

What is CVE-2021-3672?

CVE-2021-3672 is a medium-severity vulnerability in Fedoraproject Fedora, published on 23 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Weakness: CWE-79

Which versions are affected by CVE-2021-3672?

3 open source packages ship an affected version, including node, node-min and pgbouncer. It affects 17 products.

Products include C-Ares Project C-Ares, Fedoraproject Fedora, Nodejs Node.js, Pgbouncer Pgbouncer, Redhat Enterprise Linux, Redhat Enterprise Linux Computer Node and 11 more.

How do I fix CVE-2021-3672?

Upgrade node to a fixed version for your release line: 12.12.1, 12.22.5, 14.14.1 or 14.17.5.

Is CVE-2021-3672 being exploited?

There is no known exploitation of CVE-2021-3672 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2022-4904 Memory corruption in c-ares High 8.6
• CVE-2023-32067 0-byte UDP payload DoS in c-ares High 7.5
• CVE-2020-8277 Uncontrolled Resource Consumption in node High 7.5
• CVE-2023-31147 Insufficient randomness in generation of DNS query IDs in c-ares Medium 5.9
• CVE-2023-31130 Buffer Underwrite in ares_inet_net_pton() Medium 4.1

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2021-3672, ALSA-2022:2043, AZL-38359, BIT-node-2021-3672, BIT-node-min-2021-3672, BIT-pgbouncer-2021-3672 and 20 more.