CVE catalog

CVE-2021-3672

c-ares: CVE-2021-3672

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.81% · Oct 25, 2026

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianc-aressid1.34.9-1fixed
Debianc-aresforky1.34.8-1fixed
Debianc-arestrixie1.34.5-1+deb13u1fixed
Debianc-arestrixie-security1.34.5-1+deb13u1fixed
Debianc-aresbookworm1.18.1-3fixed
Bitnaminode-minNot reported12.12.1fixed
Bitnaminode-minNot reported12.22.5fixed
Bitnaminode-minNot reported14.14.1fixed
Bitnaminode-minNot reported14.17.5fixed
Bitnaminode-minNot reported16.6.2fixed
BitnamipgbouncerNot reported1.17.1fixed
BitnaminodeNot reported12.12.1fixed
BitnaminodeNot reported12.22.5fixed
BitnaminodeNot reported14.14.1fixed
BitnaminodeNot reported14.17.5fixed
BitnaminodeNot reported16.6.2fixed
Alpinec-ares3.111.17.2-r0fixed
Alpinec-ares3.121.17.2-r0fixed
Alpinec-ares3.131.17.2-r0fixed
Alpinec-ares3.141.17.2-r0fixed
Alpinec-ares3.151.17.2-r0fixed
Alpinec-ares3.161.17.2-r0fixed
Alpinec-ares3.171.17.2-r0fixed
Alpinec-ares3.181.17.2-r0fixed
Alpinec-ares3.191.17.2-r0fixed
Alpinec-ares3.201.17.2-r0fixed
Alpinec-ares3.211.17.2-r0fixed
Alpinec-ares3.221.17.2-r0fixed
Alpinec-ares3.231.17.2-r0fixed
Alpinec-ares3.241.17.2-r0fixed
Alpinenodejs3.1112.22.5-r0fixed
Alpinenodejs3.1212.22.5-r0fixed
Alpinenodejs3.1314.17.5-r0fixed
Alpinenodejs3.1414.17.5-r0fixed
Alpinenodejs3.1514.17.5-r0fixed
Alpinenodejs3.1614.17.5-r0fixed
Alpinenodejs3.1714.17.5-r0fixed
Alpinenodejs3.1814.17.5-r0fixed
Alpinenodejs3.1914.17.5-r0fixed
Alpinenodejs3.2014.17.5-r0fixed
Alpinenodejs3.2114.17.5-r0fixed
Alpinenodejs3.2214.17.5-r0fixed
Alpinenodejs3.2314.17.5-r0fixed
Alpinenodejs3.2414.17.5-r0fixed
Ubuntuc-arespro1.10.0-2vulnerable
Ubuntuc-arespro1.10.0-3vulnerable
Ubuntuc-arespro1.10.0-3ubuntu0.1vulnerable
Ubuntuc-arespro1.10.0-3ubuntu0.2vulnerable
Ubuntuc-arespro1.10.0-3ubuntu0.2+esm1fixed
Ubuntuc-arespro1.10.0-2vulnerable
Ubuntuc-arespro1.10.0-3vulnerable
Ubuntuc-arespro1.10.0-3ubuntu0.1vulnerable
Ubuntuc-arespro1.10.0-3ubuntu0.2vulnerable
Ubuntuc-arespro1.10.0-3ubuntu0.2+esm1fixed
Ubuntuc-ares18.041.13.0-2vulnerable
Ubuntuc-ares18.041.13.0-3vulnerable
Ubuntuc-ares18.041.14.0-1vulnerable
Ubuntuc-ares18.041.14.0-1ubuntu0.1fixed
Ubuntuc-ares20.041.15.0-1build1vulnerable
Ubuntuc-ares20.041.15.0-1ubuntu0.1fixed
Ubuntuc-ares22.041.17.1-1ubuntu1fixed
Ubuntuc-ares18.041.13.0-2vulnerable
Ubuntuc-ares18.041.13.0-3vulnerable
Ubuntuc-ares18.041.14.0-1vulnerable
Ubuntuc-ares18.041.14.0-1ubuntu0.1fixed
Ubuntuc-ares20.041.15.0-1build1vulnerable
Ubuntuc-ares20.041.15.0-1ubuntu0.1fixed
Opensusec-aresleap 15.21.17.1+20200724-lp152.2.9.1fixed
Opensusec-ares-testsleap 15.21.17.1+20200724-lp152.2.9.1fixed
Suselibcares2hpe helion openstack 81.9.1-9.7.1fixed
Suselibcares2openstack cloud 81.9.1-9.7.1fixed
Suselibcares2openstack cloud 91.9.1-9.7.1fixed
Suselibcares2openstack cloud crowbar 81.9.1-9.7.1fixed
Suselibcares2openstack cloud crowbar 91.9.1-9.7.1fixed
Suselibcares2linux enterprise server for sap applications 12 sp31.9.1-9.7.1fixed
Suselibcares2linux enterprise server for sap applications 12 sp41.9.1-9.7.1fixed
Suselibcares2linux enterprise software development kit 12 sp51.9.1-9.7.1fixed
Suselibcares2linux enterprise server 12 sp2-bcl1.9.1-9.7.1fixed
Suselibcares2linux enterprise server 12 sp3-ltss1.9.1-9.7.1fixed
Suselibcares2linux enterprise server 12 sp3-bcl1.9.1-9.7.1fixed
Suselibcares2linux enterprise server 12 sp4-ltss1.9.1-9.7.1fixed
Suselibcares2linux enterprise server 12 sp51.9.1-9.7.1fixed
Suselibcares2linux enterprise server for sap applications 12 sp51.9.1-9.7.1fixed
Suselibcares2linux enterprise workstation extension 12 sp51.9.1-9.7.1fixed
Susec-areslinux enterprise module for basesystem 15 sp21.17.1+20200724-3.14.1fixed
Susec-areslinux enterprise module for basesystem 15 sp31.17.1+20200724-3.14.1fixed
Susec-areslinux enterprise high performance computing 15-espos1.17.1+20200724-3.14.1fixed
Susec-areslinux enterprise high performance computing 15-ltss1.17.1+20200724-3.14.1fixed
Susec-areslinux enterprise high performance computing 15 sp1-espos1.17.1+20200724-3.14.1fixed
Susec-areslinux enterprise high performance computing 15 sp1-ltss1.17.1+20200724-3.14.1fixed
Susec-areslinux enterprise server 15-ltss1.17.1+20200724-3.14.1fixed
Susec-areslinux enterprise server 15 sp1-bcl1.17.1+20200724-3.14.1fixed
Susec-areslinux enterprise server 15 sp1-ltss1.17.1+20200724-3.14.1fixed
Susec-areslinux enterprise server for sap applications 151.17.1+20200724-3.14.1fixed
Susec-areslinux enterprise server for sap applications 15 sp11.17.1+20200724-3.14.1fixed
Susec-aresmanager proxy 4.01.17.1+20200724-3.14.1fixed
Susec-aresmanager retail branch server 4.01.17.1+20200724-3.14.1fixed
Susec-aresmanager server 4.01.17.1+20200724-3.14.1fixed
Susec-aresenterprise storage 61.17.1+20200724-3.14.1fixed
Suselibcares2linux enterprise point of sale 11 sp31.7.4-7.10.3.1fixed
Suselibcares2linux enterprise server 11 sp4-ltss1.7.4-7.10.3.1fixed
Opensusec-aresleap 15.31.17.1+20200724-3.14.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianc-aressourcesid1.17.1-1.1not yet assignedNot reported[992053]
Debianc-aressourceforky1.17.1-1.1not yet assignedNot reported[992053]
Debianc-aressourcetrixie1.17.1-1.1not yet assignedNot reported[992053]
Debianc-aressourcebookworm1.17.1-1.1not yet assignedNot reported[992053]
Bitnaminode-minBitnamiNot reported12.12.1Not reportedBIT-NODE-MIN-2021-3672Not reported
Bitnaminode-minBitnamiNot reported12.22.5Not reportedBIT-NODE-MIN-2021-3672Not reported
Bitnaminode-minBitnamiNot reported14.14.1Not reportedBIT-NODE-MIN-2021-3672Not reported
Bitnaminode-minBitnamiNot reported14.17.5Not reportedBIT-NODE-MIN-2021-3672Not reported
Bitnaminode-minBitnamiNot reported16.6.2Not reportedBIT-NODE-MIN-2021-3672Not reported
BitnamipgbouncerBitnamiNot reported1.17.1Not reportedBIT-PGBOUNCER-2021-3672Not reported
BitnaminodeBitnamiNot reported12.12.1Not reportedBIT-NODE-2021-3672Not reported
BitnaminodeBitnamiNot reported12.22.5Not reportedBIT-NODE-2021-3672Not reported
BitnaminodeBitnamiNot reported14.14.1Not reportedBIT-NODE-2021-3672Not reported
BitnaminodeBitnamiNot reported14.17.5Not reportedBIT-NODE-2021-3672Not reported
BitnaminodeBitnamiNot reported16.6.2Not reportedBIT-NODE-2021-3672Not reported
Alpinec-aresapk3.111.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.121.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.131.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.141.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.151.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.161.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.171.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.181.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.191.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.201.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.211.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.221.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.231.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinec-aresapk3.241.17.2-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.1112.22.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.1212.22.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.1314.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.1414.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.1514.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.1614.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.1714.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.1814.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.1914.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.2014.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.2114.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.2214.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.2314.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Alpinenodejsapk3.2414.17.5-r0Not reportedALPINE-CVE-2021-3672Not reported
Ubuntuc-aresdebpro1.10.0-3ubuntu0.2+esm1Not reportedUSN-5034-2Not reported
Ubuntuc-aresdebpro1.10.0-3ubuntu0.2+esm1Not reportedUBUNTU-CVE-2021-3672Not reported
Ubuntuc-aresdeb18.041.14.0-1ubuntu0.1Not reportedUBUNTU-CVE-2021-3672Not reported
Ubuntuc-aresdeb20.041.15.0-1ubuntu0.1Not reportedUBUNTU-CVE-2021-3672Not reported
Ubuntuc-aresdeb22.041.17.1-1ubuntu1Not reportedUBUNTU-CVE-2021-3672Not reported
Ubuntuc-aresdeb18.041.14.0-1ubuntu0.1Not reportedUSN-5034-1Not reported
Ubuntuc-aresdeb20.041.15.0-1ubuntu0.1Not reportedUSN-5034-1Not reported
Opensusec-aresrpmleap 15.21.17.1+20200724-lp152.2.9.1Not reportedOPENSUSE-SU-2021:1168-1Not reported
Opensusec-ares-testsrpmleap 15.21.17.1+20200724-lp152.2.9.1Not reportedOPENSUSE-SU-2021:1168-1Not reported
Suselibcares2rpmhpe helion openstack 81.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmopenstack cloud 81.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmopenstack cloud 91.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmopenstack cloud crowbar 81.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmopenstack cloud crowbar 91.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmlinux enterprise server for sap applications 12 sp31.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmlinux enterprise server for sap applications 12 sp41.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmlinux enterprise software development kit 12 sp51.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmlinux enterprise server 12 sp2-bcl1.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmlinux enterprise server 12 sp3-ltss1.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmlinux enterprise server 12 sp3-bcl1.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmlinux enterprise server 12 sp4-ltss1.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmlinux enterprise server 12 sp51.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmlinux enterprise server for sap applications 12 sp51.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Suselibcares2rpmlinux enterprise workstation extension 12 sp51.9.1-9.7.1Not reportedSUSE-SU-2021:2690-1Not reported
Susec-aresrpmlinux enterprise module for basesystem 15 sp21.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmlinux enterprise module for basesystem 15 sp31.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmlinux enterprise high performance computing 15-espos1.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmlinux enterprise high performance computing 15-ltss1.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmlinux enterprise high performance computing 15 sp1-espos1.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmlinux enterprise high performance computing 15 sp1-ltss1.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmlinux enterprise server 15-ltss1.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmlinux enterprise server 15 sp1-bcl1.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmlinux enterprise server 15 sp1-ltss1.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmlinux enterprise server for sap applications 151.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmlinux enterprise server for sap applications 15 sp11.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmmanager proxy 4.01.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmmanager retail branch server 4.01.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmmanager server 4.01.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Susec-aresrpmenterprise storage 61.17.1+20200724-3.14.1Not reportedSUSE-SU-2021:2760-1Not reported
Suselibcares2rpmlinux enterprise point of sale 11 sp31.7.4-7.10.3.1Not reportedSUSE-SU-2021:14776-1Not reported
Suselibcares2rpmlinux enterprise server 11 sp4-ltss1.7.4-7.10.3.1Not reportedSUSE-SU-2021:14776-1Not reported
Opensusec-aresrpmleap 15.31.17.1+20200724-3.14.1Not reportedOPENSUSE-SU-2021:2760-1Not reported

[Debian bug #992053]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libc-ares2]Unknown

    Source package: [c-ares]

    Details (2)
    • 1.18.1-3 · amd64 · bookworm

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · bookworm; dsa · c-ares · debian · 12

    • 1.18.1-3 · arm64 · bookworm

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · bookworm; dsa · c-ares · debian · 12

  • [libc-ares-dev]Unknown

    Source package: [c-ares]

    Details (2)
    • 1.18.1-3 · amd64 · bookworm

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · bookworm; dsa · c-ares · debian · 12

    • 1.18.1-3 · arm64 · bookworm

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · bookworm; dsa · c-ares · debian · 12

[Debian 13 (Trixie)]

  • [libc-ares2]Unknown

    Source package: [c-ares]

    Details (4)
    • 1.34.5-1+deb13u1 · all · trixie

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

    • 1.34.5-1+deb13u1 · all · trixie

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

    • 1.34.5-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

    • 1.34.5-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

  • [libcares2]Unknown

    Source package: [c-ares]

    Details (4)
    • 1.34.5-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

    • 1.34.5-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

    • 1.34.5-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

    • 1.34.5-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

  • [libc-ares-dev]Unknown

    Source package: [c-ares]

    Details (4)
    • 1.34.5-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

    • 1.34.5-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

    • 1.34.5-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

    • 1.34.5-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.17.1-1.1

      dsa · c-ares · debian · 13

Observed:

References