Alerts This Week
Warning Icon 1 483
Alerts This Week
Warning Icon 1 483

Debian 9 Stretch DLA-2738-1 Critical: c-ares Input Validation Issue

debian lts
Calendar Grey August 10, 2021
Dist Debian Esm H88
A vulnerability in c-ares may produce incorrect hostname results; an upgrade is advised. See Advisory DLA-2740-1.
An issue has been found in c-ares, an asynchronous name resolver
Topics%20covered

Topics Covered

security advisory debian input validation dns issue asynchronous resolver

Summary

An issue has been found in c-ares, an asynchronous name resolver.
Missing input validation of host names returned by Domain Name Servers can
lead to output of wrong hostnames.


For Debian 9 stretch, this problem has been fixed in version
1.12.0-1+deb9u2.

We recommend that you upgrade your c-ares packages.

For the detailed security status of c-ares please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/c-ares

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



Severity
critical
Lowest
Low
Medium
High
Critical

Package: c-ares
Version: 1.12.0-1+deb9u2
CVE ID: CVE-2021-3672

Topics%20covered

Topics Covered

security advisory debian input validation dns issue asynchronous resolver

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here