RHSA-2022:2043: Moderate: c-ares security update
The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.Security Fix(es): c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:2043?
The severity level of RHSA-2022:2043 is considered moderate.
How do I fix RHSA-2022:2043?
To fix RHSA-2022:2043, upgrade to c-ares version 1.13.0-6.el8 or later.
What is CVE-2021-3672 associated with RHSA-2022:2043?
CVE-2021-3672 refers to the missing input validation of host names in the c-ares library that could lead to domain hijacking.
Which packages are affected by RHSA-2022:2043?
The affected packages include c-ares, c-ares-debuginfo, c-ares-debugsource, and c-ares-devel for various architectures.
Is there a mitigation for RHSA-2022:2043?
The primary mitigation for RHSA-2022:2043 is to regularly update c-ares to the recommended version to prevent potential exploits.