MEDIUM 5.6 Microsoft
CVE-2021-3672
A flaw was found in c-ares library where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.
Microsoft Security Update 2021-Nov: A flaw was found in c-ares library where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.
Affected Products
- cm1 pgbouncer 1.16.1-1 on CBL Mariner 1.0
- cm1 c-ares 1.18.1-1 on CBL Mariner 1.0
- cbl2 pgbouncer 1.16.1-1 on CBL Mariner 2.0
- azl3 ceph 18.2.2-1 on Azure Linux 3.0
- azl3 rubygem-mini_portile2 2.8.4-1 on Azure Linux 3.0
- azl3 tensorflow 2.16.1-9 on Azure Linux 3.0
- cbl2 ceph 16.2.10-7 on CBL-Mariner 2.0
- azl3 ceph 18.2.2-8 on Azure Linux 3.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-3672
- https://nvd.nist.gov/vuln/detail/CVE-2021-3672
This medium severity vulnerability with a CVSS score of 5.6 was published on 2021-11-09 via Microsoft. Affected: cm1 pgbouncer 1.16.1-1 on CBL Mariner 1.0, cm1 c-ares 1.18.1-1 on CBL Mariner 1.0, cbl2 pgbouncer 1.16.1-1 on CBL Mariner 2.0 and 5 more.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.