CVE-2021-3672

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-3672
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3672.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-3672
Aliases
Downstream
Related
Published
2021-11-23T19:15:07.877Z
Modified
2026-07-08T06:02:36.421053150Z
Severity
  • 5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_RANGE",
            "cpes": [
                "cpe:2.3:a:pgbouncer:pgbouncer:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "pgbouncer:pgbouncer",
            "extracted_events": [
                {
                    "last_affected": "1.17.0"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "fixed": "1.0.1.1"
                }
            ],
            "cpes": [
                "cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "siemens:sinec_infrastructure_network_services",
            "source": "CPE_RANGE"
        },
        {
            "extracted_events": [
                {
                    "introduced": "33"
                },
                {
                    "last_affected": "33"
                },
                {
                    "introduced": "34"
                },
                {
                    "last_affected": "34"
                }
            ],
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
            ],
            "vendor_product": "fedoraproject:fedora",
            "source": "CPE_STRING"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux:7.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux",
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0"
                },
                {
                    "introduced": "7.7"
                },
                {
                    "last_affected": "7.7"
                },
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ]
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_computer_node:1:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_computer_node",
            "extracted_events": [
                {
                    "introduced": "1"
                },
                {
                    "last_affected": "1"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "7.7"
                },
                {
                    "last_affected": "7.7"
                },
                {
                    "introduced": "8.1"
                },
                {
                    "last_affected": "8.1"
                },
                {
                    "introduced": "8.2"
                },
                {
                    "last_affected": "8.2"
                },
                {
                    "introduced": "8.4"
                },
                {
                    "last_affected": "8.4"
                }
            ],
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_eus",
            "source": "CPE_STRING"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_for_ibm_z_systems",
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ]
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_for_ibm_z_systems_eus",
            "extracted_events": [
                {
                    "introduced": "8.1"
                },
                {
                    "last_affected": "8.1"
                },
                {
                    "introduced": "8.2"
                },
                {
                    "last_affected": "8.2"
                },
                {
                    "introduced": "8.4"
                },
                {
                    "last_affected": "8.4"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ],
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_for_power_little_endian",
            "source": "CPE_STRING"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_for_power_little_endian_eus",
            "extracted_events": [
                {
                    "introduced": "8.1"
                },
                {
                    "last_affected": "8.1"
                },
                {
                    "introduced": "8.2"
                },
                {
                    "last_affected": "8.2"
                },
                {
                    "introduced": "8.4"
                },
                {
                    "last_affected": "8.4"
                }
            ]
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_server_aus",
            "extracted_events": [
                {
                    "introduced": "8.2"
                },
                {
                    "last_affected": "8.2"
                },
                {
                    "introduced": "8.4"
                },
                {
                    "last_affected": "8.4"
                }
            ]
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_server_tus",
            "extracted_events": [
                {
                    "introduced": "8.2"
                },
                {
                    "last_affected": "8.2"
                },
                {
                    "introduced": "8.4"
                },
                {
                    "last_affected": "8.4"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "8.1"
                },
                {
                    "last_affected": "8.1"
                },
                {
                    "introduced": "8.2"
                },
                {
                    "last_affected": "8.2"
                },
                {
                    "introduced": "8.4"
                },
                {
                    "last_affected": "8.4"
                }
            ],
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_server_update_services_for_sap_solutions",
            "source": "CPE_STRING"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_tus:8.4:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_tus",
            "extracted_events": [
                {
                    "introduced": "8.4"
                },
                {
                    "last_affected": "8.4"
                }
            ]
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux_workstation:1:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:enterprise_linux_workstation",
            "extracted_events": [
                {
                    "introduced": "1"
                },
                {
                    "last_affected": "1"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/c-ares/c-ares

Affected ranges

Type
GIT
Repo
https://github.com/c-ares/c-ares
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6654436a307a5a686b008c1d4c93b0085da6e6d8
Database specific 
{
    "cpe": "cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.17.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

Other
c-ares-1_17_0
c-ares-1_2_0
cares-1_10_0
cares-1_11_0
cares-1_11_0-rc1
cares-1_12_0
cares-1_13_0
cares-1_14_0
cares-1_15_0
cares-1_16_0
cares-1_16_1
cares-1_17_1
cares-1_1_0
cares-1_2_1
cares-1_3_1
cares-1_3_2
cares-1_4_0
cares-1_5_0
cares-1_5_1
cares-1_5_2
cares-1_5_3
cares-1_6_0
cares-1_7_0
cares-1_7_1
cares-1_7_2
cares-1_7_3
cares-1_7_4
cares-1_7_5
cares-1_8_0
cares-1_9_0
cares-1_9_1
curl-7_10_8
curl-7_11_0
curl-7_11_1
curl-7_12_0
curl-7_12_1
curl-7_12_2
curl-7_13_0
curl-7_13_1
curl-7_13_2
curl-7_14_0
curl-7_14_1
curl-7_15_0
curl-7_15_1
curl-7_15_3
curl-7_15_4
curl-7_15_5
curl-7_15_6-prepipeline
curl-7_16_0
curl-7_16_1
curl-7_16_2
curl-7_16_3
curl-7_16_4
curl-7_17_0
curl-7_17_1
curl-7_18_0
curl-7_18_1
curl-7_18_2
curl-7_19_0
curl-7_19_2
curl-7_19_3
curl-7_19_4
curl-7_19_5
curl-7_19_6
curl-7_19_7
curl-7_20_0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3672.json"

Git / github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events
Introduced
2f45ad8060e13d5ac912335096d21526f2f9602b
Last affected
921493e2287aa895679620155b5288b2e1587bfd
Introduced
42cce5a9d0fd905bf4ad7a2528c36572dfb8b5ad
Fixed
151261efb8b85696620f80ecc1f50d9c1f886a1b
Introduced
73aa21658dfa6a22c06451d080152b32b1f98dbe
Last affected
354b6a93bd1d66f1833489d6fe01a2b0e8f6aff9
Introduced
c1da528bc25c9cc5a8240a7b4f136f5968f6e113
Fixed
db159ab870b1aa7f55e4e450c81764f22bf0ef80
Introduced
7162e686b18d22b4385fa5c04274fb04dbd810c7
Fixed
bfe80913e88139da1aa283475cdbc060ea98ae6f
Database specific 
{
    "cpe": [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "12.0.0"
        },
        {
            "last_affected": "12.12.0"
        },
        {
            "introduced": "12.13.0"
        },
        {
            "fixed": "12.22.5"
        },
        {
            "introduced": "14.0.0"
        },
        {
            "last_affected": "14.14.0"
        },
        {
            "introduced": "14.15.0"
        },
        {
            "fixed": "14.17.5"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.6.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v12.*
v12.0.0
v12.1.0
v12.10.0
v12.11.0
v12.11.1
v12.12.0
v12.13.0
v12.13.1
v12.14.0
v12.14.1
v12.15.0
v12.16.0
v12.16.1
v12.16.2
v12.16.3
v12.17.0
v12.18.0
v12.18.1
v12.18.2
v12.18.3
v12.18.4
v12.19.0
v12.19.1
v12.2.0
v12.20.0
v12.20.1
v12.20.2
v12.21.0
v12.22.0
v12.22.1
v12.22.2
v12.22.3
v12.22.4
v12.3.0
v12.3.1
v12.4.0
v12.5.0
v12.6.0
v12.7.0
v12.8.0
v12.8.1
v12.9.0
v12.9.1
v14.*
v14.0.0
v14.1.0
v14.10.0
v14.10.1
v14.11.0
v14.12.0
v14.13.0
v14.13.1
v14.14.0
v14.15.0
v14.15.1
v14.15.2
v14.15.3
v14.15.4
v14.15.5
v14.16.0
v14.16.1
v14.17.0
v14.17.1
v14.17.2
v14.17.3
v14.17.4
v14.2.0
v14.3.0
v14.4.0
v14.5.0
v14.6.0
v14.7.0
v14.8.0
v14.9.0
v16.*
v16.0.0
v16.1.0
v16.2.0
v16.3.0
v16.4.0
v16.4.1
v16.4.2
v16.5.0
v16.6.0
v16.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3672.json"