{"id":"CVE-2021-3672","details":"A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.","aliases":["BIT-node-2021-3672","BIT-node-min-2021-3672","BIT-pgbouncer-2021-3672"],"modified":"2026-07-10T12:01:36.836003389Z","published":"2021-11-23T19:15:07.877Z","related":["ALSA-2021:3623","ALSA-2021:3666","ALSA-2022:2043","SUSE-SU-2021:14776-1","SUSE-SU-2021:2690-1","SUSE-SU-2021:2760-1","SUSE-SU-2021:2823-1","SUSE-SU-2021:2824-1","SUSE-SU-2021:2875-1","SUSE-SU-2021:2953-1","SUSE-SU-2021:3184-1","SUSE-SU-2021:3211-1","openSUSE-SU-2021:1168-1","openSUSE-SU-2021:1214-1","openSUSE-SU-2021:1239-1","openSUSE-SU-2021:1313-1","openSUSE-SU-2021:2760-1","openSUSE-SU-2021:2875-1","openSUSE-SU-2021:2953-1","openSUSE-SU-2021:3211-1","openSUSE-SU-2024:10668-1","openSUSE-SU-2024:11096-1","openSUSE-SU-2024:11097-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"extracted_events":[{"introduced":"12.0.0"},{"last_affected":"12.12.0"},{"introduced":"12.13.0"},{"fixed":"12.22.5"},{"introduced":"14.0.0"},{"last_affected":"14.14.0"},{"introduced":"14.15.0"},{"fixed":"14.17.5"},{"introduced":"16.0.0"},{"fixed":"16.6.2"}],"source":"CPE_RANGE","vendor_product":"nodejs:node.js"},{"source":"CPE_RANGE","vendor_product":"pgbouncer:pgbouncer","cpes":["cpe:2.3:a:pgbouncer:pgbouncer:*:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"1.17.0"}]},{"extracted_events":[{"fixed":"1.0.1.1"}],"source":"CPE_RANGE","vendor_product":"siemens:sinec_infrastructure_network_services","cpes":["cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"33"},{"last_affected":"33"},{"introduced":"34"},{"last_affected":"34"}]},{"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"},{"introduced":"7.7"},{"last_affected":"7.7"},{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux","cpes":["cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux:7.7:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"1"},{"last_affected":"1"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_computer_node","cpes":["cpe:2.3:o:redhat:enterprise_linux_computer_node:1:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_eus","cpes":["cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.7"},{"last_affected":"7.7"},{"introduced":"8.1"},{"last_affected":"8.1"},{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.4"},{"last_affected":"8.4"}]},{"vendor_product":"redhat:enterprise_linux_for_ibm_z_systems","cpes":["cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.1"},{"last_affected":"8.1"},{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.4"},{"last_affected":"8.4"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_for_ibm_z_systems_eus"},{"vendor_product":"redhat:enterprise_linux_for_power_little_endian","cpes":["cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.1"},{"last_affected":"8.1"},{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.4"},{"last_affected":"8.4"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_for_power_little_endian_eus"},{"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_aus","cpes":["cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.4"},{"last_affected":"8.4"}]},{"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_tus","cpes":["cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.4"},{"last_affected":"8.4"}]},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.1"},{"last_affected":"8.1"},{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.4"},{"last_affected":"8.4"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_update_services_for_sap_solutions"},{"vendor_product":"redhat:enterprise_linux_tus","cpes":["cpe:2.3:o:redhat:enterprise_linux_tus:8.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.4"},{"last_affected":"8.4"}],"source":"CPE_STRING"},{"vendor_product":"redhat:enterprise_linux_workstation","cpes":["cpe:2.3:o:redhat:enterprise_linux_workstation:1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1"},{"last_affected":"1"}],"source":"CPE_STRING"}]},"references":[{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202401-02"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988342"},{"type":"FIX","url":"https://c-ares.haxx.se/adv_20210810.html"},{"type":"FIX","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/c-ares/c-ares","events":[{"introduced":"0"},{"fixed":"6654436a307a5a686b008c1d4c93b0085da6e6d8"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.17.2"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:*"}}],"versions":["cares-1_17_1","c-ares-1_17_0","cares-1_16_1","cares-1_16_0","cares-1_15_0","cares-1_14_0","cares-1_13_0","cares-1_12_0","cares-1_11_0","cares-1_11_0-rc1","cares-1_10_0","cares-1_9_1","cares-1_9_0","cares-1_8_0","cares-1_7_5","cares-1_7_4","cares-1_7_3","cares-1_7_2","cares-1_7_1","curl-7_20_0","cares-1_7_0","curl-7_19_7","curl-7_19_6","curl-7_19_5","curl-7_19_4","curl-7_19_3","cares-1_6_0","curl-7_19_2","curl-7_19_0","cares-1_5_3","curl-7_18_2","cares-1_5_2","curl-7_18_1","curl-7_18_0","cares-1_5_1","cares-1_5_0","curl-7_17_1","curl-7_17_0","curl-7_16_4","curl-7_16_3","cares-1_4_0","curl-7_16_2","curl-7_16_1","cares-1_3_2","curl-7_16_0","curl-7_15_6-prepipeline","curl-7_15_5","cares-1_3_1","curl-7_15_4","curl-7_15_3","curl-7_15_1","curl-7_15_0","curl-7_14_1","curl-7_14_0","curl-7_13_2","curl-7_13_1","curl-7_13_0","cares-1_2_1","curl-7_12_2","curl-7_12_1","curl-7_12_0","c-ares-1_2_0","curl-7_11_1","cares-1_1_0","curl-7_11_0","curl-7_10_8"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-3672.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}