c-ares: CVE-2021-3672: Missing input validation on hostnames returned by DNS servers

Debian Bug report logs - #992053
c-ares: CVE-2021-3672: Missing input validation on hostnames returned by DNS servers

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: c-ares: CVE-2021-3672: Missing input validation on hostnames returned by DNS servers

Date: Tue, 10 Aug 2021 08:24:41 +0200

Source: c-ares
Version: 1.17.1-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1.14.0-1
Control: fixed -1 1.14.0-1+deb10u1
Control: fixed -1 1.17.1-1+deb11u1

Hi,

The following vulnerability was published for c-ares.

CVE-2021-3672[0]:
| Missing input validation on hostnames returned by DNS servers

Respective bullseye-security and buster-security updates are preapred
and as well a NMU for unstable. Will attach the debdiff shortly.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-3672
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3672
[1] https://c-ares.haxx.se/adv_20210810.html
[2] https://github.com/c-ares/c-ares/commit/362f91d807d293791008cdb7616d40f7784ece83
[3] https://github.com/c-ares/c-ares/commit/44c009b8e62ea1929de68e3f438181bea469ec14

Regards,
Salvatore

Message #16 received at 992053@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 992053@bugs.debian.org

Subject: c-ares: diff for NMU version 1.17.1-1.1

Date: Tue, 10 Aug 2021 08:35:56 +0200

[Message part 1 (text/plain, inline)]

Control: tags 992053 + patch
Control: tags 992053 + pending


Dear maintainer,

I've prepared an NMU for c-ares (versioned as 1.17.1-1.1) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer.

Regards,
Salvatore

[c-ares-1.17.1-1.1-nmu.diff (text/x-diff, attachment)]

Send a report that this bug log contains spam.