Every CVE Search/ Get API key

CVE-2021-3672

A flaw was found in c-ares library, where a missing input validation check of host names returned...

5.6 MediumFix available

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

2.81%Up 2.2 points since Nov 24, 2021
90%50%10%1%

What each source reports

NVD Score used 5.6

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
CVE-2021-3672
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
CVE-2021-3672
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2021-26964 No score

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
EUVD-2021-26964
Updated
2026-11-03
GitHub AdvisoriesGHSA-hghm-3vc3-hppj 5.6

A flaw was found in c-ares library, where a missing input validation check of host names returned...

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
GHSA-hghm-3vc3-hppj
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
OSVALPINE-CVE-2021-3672 5.6

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
ALPINE-CVE-2021-3672
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
OSVAZL-38359 5.6

CVE-2021-3672 affecting package ceph for versions less than 18.2.2-1

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
AZL-38359
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-05
Show 45 moreShow less
OSVBELL-CVE-2021-3672 5.6

CVE-2021-3672 does not affect BellSoft software

Record
BELL-CVE-2021-3672
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSV 5.6

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
CVE-2021-3672
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2021-3672 5.6

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
DEBIAN-CVE-2021-3672
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2021-1313 5.0

c-ares security update

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple.

Security Fix(es):

Missing input validation of host names returned by Domain Name Servers in the c-ares library can lead to output of wrong hostnames (leading to Domain Hijacking).(CVE-2021-3672)

Record
OESA-2021-1313
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2021:3280 9.8

Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

Record
RHSA-2021:3280
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3281 9.8

Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update

Record
RHSA-2021:3281
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3623 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2021:3623
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3638 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2021:3638
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3639 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2021:3639
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3666 9.8

Red Hat Security Advisory: nodejs:14 security and bug fix update

Record
RHSA-2021:3666
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:2043 5.6

Red Hat Security Advisory: c-ares security update

Record
RHSA-2022:2043
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2021:3623 9.8

Important: nodejs:12 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

  • c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

  • nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  • nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

  • nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

  • nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  • nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)
Record
RLSA-2021:3623
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:3666 9.8

Important: nodejs:14 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

  • c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

  • nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  • nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

  • nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

  • nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  • nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)
Record
RLSA-2021:3666
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:2043 5.6

Moderate: c-ares security update

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

  • c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Record
RLSA-2022:2043
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3672 5.6

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
UBUNTU-CVE-2021-3672
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVALSA-2021:3623 No score

Important: nodejs:12 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

  • c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

  • nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  • nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

  • nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

  • nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  • nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)
Record
ALSA-2021:3623
Updated
2026-11-02
OSVALSA-2021:3666 No score

Important: nodejs:14 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

  • nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

  • c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

  • nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  • nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

  • nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

  • nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  • nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)
Record
ALSA-2021:3666
Updated
2026-11-02
OSVALSA-2022:2043 No score

Moderate: c-ares security update

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

  • c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:2043
Updated
2026-11-02
OSVBIT-node-2021-3672 No score

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
BIT-node-2021-3672
Updated
2026-11-02
OSVBIT-node-min-2021-3672 No score

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
BIT-node-min-2021-3672
Updated
2026-11-02
OSVBIT-pgbouncer-2021-3672 No score

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Record
BIT-pgbouncer-2021-3672
Updated
2026-11-02
OSVMGASA-2021-0453 No score

Updated c-ares packages fix security vulnerability

Missing input validation on hostnames returned by DNS servers. (CVE-2021-3672)

Record
MGASA-2021-0453
Updated
2026-11-02
OSVMGASA-2021-0463 No score

Updated nodejs packages fix security vulnerability

Multiple security fixes for nodejs. See references for details

Record
MGASA-2021-0463
Updated
2026-11-02
OSVopenSUSE-SU-2021:1168-1 No score

Security update for c-ares

This update for c-ares fixes the following issues:

Version update to git snapshot 1.17.1+20200724:

  • CVE-2021-3672: fixed missing input validation on hostnames returned by DNS servers (bsc#1188881)
  • If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause crash
  • Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response
  • Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing
  • Use unbuffered /dev/urandom for random data to prevent early startup performance issues

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:1168-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1214-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

Update to 12.22.5:

  • CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)
  • CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
  • CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1214-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1239-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
  • CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).
  • CVE-2021-22939: Fixed incomplete validation of rejectUnauthorized parameter (bsc#1189369).
  • CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:1239-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1313-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

  • CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
  • CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
  • CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
  • CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1313-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2760-1 No score

Security update for c-ares

This update for c-ares fixes the following issues:

Version update to git snapshot 1.17.1+20200724:

  • CVE-2021-3672: fixed missing input validation on hostnames returned by DNS servers (bsc#1188881)
  • If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause crash
  • Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response
  • Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing
  • Use unbuffered /dev/urandom for random data to prevent early startup performance issues
Record
openSUSE-SU-2021:2760-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2875-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

Update to 12.22.5:

  • CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)
  • CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
  • CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)
Record
openSUSE-SU-2021:2875-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2953-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
  • CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).
  • CVE-2021-22939: Fixed incomplete validation of rejectUnauthorized parameter (bsc#1189369).
  • CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
Record
openSUSE-SU-2021:2953-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:3211-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

  • CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
  • CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
  • CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
  • CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).
Record
openSUSE-SU-2021:3211-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10668-1 No score

c-ares-devel-1.17.2-2.2 on GA media

These are all security issues fixed in the c-ares-devel-1.17.2-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10668-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11096-1 No score

nodejs14-14.17.5-1.2 on GA media

These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11096-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11097-1 No score

nodejs16-16.6.2-2.2 on GA media

These are all security issues fixed in the nodejs16-16.6.2-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11097-1
Updated
2026-11-02
OSVSUSE-SU-2021:14776-1 No score

Security update for libcares2

This update for libcares2 fixes the following issues:

  • CVE-2021-3672: Fixed input validation on hostnames (bsc#1188881).
Record
SUSE-SU-2021:14776-1
Updated
2026-11-02
OSVSUSE-SU-2021:2690-1 No score

Security update for libcares2

This update for libcares2 fixes the following issues:

  • CVE-2021-3672: Fixed input validation on hostnames (bsc#1188881).
Record
SUSE-SU-2021:2690-1
Updated
2026-11-02
OSVSUSE-SU-2021:2760-1 No score

Security update for c-ares

This update for c-ares fixes the following issues:

Version update to git snapshot 1.17.1+20200724:

  • CVE-2021-3672: fixed missing input validation on hostnames returned by DNS servers (bsc#1188881)
  • If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause crash
  • Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response
  • Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing
  • Use unbuffered /dev/urandom for random data to prevent early startup performance issues
Record
SUSE-SU-2021:2760-1
Updated
2026-11-02
OSVSUSE-SU-2021:2823-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
  • CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).
  • CVE-2021-22939: Fixed incomplete validation of rejectUnauthorized parameter (bsc#1189369).
  • CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
Record
SUSE-SU-2021:2823-1
Updated
2026-11-02
OSVSUSE-SU-2021:2824-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

Update to 12.22.5:

  • CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)
  • CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
  • CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)
Record
SUSE-SU-2021:2824-1
Updated
2026-11-02
OSVSUSE-SU-2021:2875-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

Update to 12.22.5:

  • CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)
  • CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
  • CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)
Record
SUSE-SU-2021:2875-1
Updated
2026-11-02
OSVSUSE-SU-2021:2953-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
  • CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).
  • CVE-2021-22939: Fixed incomplete validation of rejectUnauthorized parameter (bsc#1189369).
  • CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
Record
SUSE-SU-2021:2953-1
Updated
2026-11-02
OSVSUSE-SU-2021:3184-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

  • CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
  • CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
  • CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
  • CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).
Record
SUSE-SU-2021:3184-1
Updated
2026-11-02
OSVSUSE-SU-2021:3211-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

  • CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
  • CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
  • CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
  • CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).
Record
SUSE-SU-2021:3211-1
Updated
2026-11-02
OSVUSN-5034-1 No score

c-ares vulnerability

Philipp Jeitner and Haya Shulman discovered that c-ares incorrectly validated certain hostnames returned by DNS servers. A remote attacker could possibly use this issue to perform Domain Hijacking attacks.

Record
USN-5034-1
Updated
2026-11-02
OSVUSN-5034-2 No score

c-ares vulnerability

USN-5034-1 fixed a vulnerability in c-ares. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

Philipp Jeitner and Haya Shulman discovered that c-ares incorrectly validated certain hostnames returned by DNS servers. A remote attacker could possibly use this issue to perform Domain Hijacking attacks.

Record
USN-5034-2
Updated
2026-11-02

Affected products

Show 6 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
c-ares
Alpine:v3.11
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.12
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.13
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.14
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.15
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.16
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.17
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.18
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.19
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.20
 1.0.0 up to 1.17.2-r0
1.17.2-r0
Show 177 moreShow less
Affected packages
PackageAffectedFixed
c-ares
Alpine:v3.21
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.22
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.23
 1.0.0 up to 1.17.2-r0
1.17.2-r0
c-ares
Alpine:v3.24
 1.0.0 up to 1.17.2-r0
1.17.2-r0
nodejs
Alpine:v3.11
 before 12.22.5-r0
12.22.5-r0
nodejs
Alpine:v3.12
 before 12.22.5-r0
12.22.5-r0
nodejs
Alpine:v3.13
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.14
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.15
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.16
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.17
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.18
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.19
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.20
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.21
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.22
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.23
 before 14.17.5-r0
14.17.5-r0
nodejs
Alpine:v3.24
 before 14.17.5-r0
14.17.5-r0
nodejs-current
Alpine:v3.14
 before 16.11.1-r0
16.11.1-r0
nodejs-current
Alpine:v3.15
 before 16.6.2-r0
16.6.2-r0
nodejs-current
Alpine:v3.16
 before 16.6.2-r0
16.6.2-r0
nodejs-current
Alpine:v3.17
 before 16.6.2-r0
16.6.2-r0
nodejs-current
Alpine:v3.18
 before 16.6.2-r0
16.6.2-r0
nodejs-current
Alpine:v3.19
 before 16.6.2-r0
16.6.2-r0
nodejs-current
Alpine:v3.20
 before 16.6.2-r0
16.6.2-r0
nodejs-current
Alpine:v3.21
 before 16.6.2-r0
16.6.2-r0
nodejs-current
Alpine:v3.22
 before 16.6.2-r0
16.6.2-r0
nodejs-current
Alpine:v3.23
 before 16.6.2-r0
16.6.2-r0
nodejs-current
Alpine:v3.24
 before 16.6.2-r0
16.6.2-r0
nodejs
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
1:12.22.5-1.module_el8.4.0+2529+af52a4c7
nodejs
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.5.0+85+79a7b441
1:12.22.5-1.module_el8.5.0+85+79a7b441
nodejs-devel
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.5.0+85+79a7b441
1:12.22.5-1.module_el8.5.0+85+79a7b441
nodejs-devel
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
1:12.22.5-1.module_el8.4.0+2529+af52a4c7
nodejs-docs
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
1:12.22.5-1.module_el8.4.0+2529+af52a4c7
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.5.0+85+79a7b441
1:12.22.5-1.module_el8.5.0+85+79a7b441
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
1:12.22.5-1.module_el8.4.0+2529+af52a4c7
nodejs-nodemon
AlmaLinux:8
From an advisory covering 8 CVEs
 before 2.0.3-1.module_el8.4.0+2521+c668cc9f
2.0.3-1.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
npm
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7
1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7
npm
AlmaLinux:8
From an advisory covering 8 CVEs
 before 1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441
1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 23-3.module_el8.5.0+254+b4526b16
23-3.module_el8.5.0+254+b4526b16
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
 before 23-3.module_el8.4.0+2522+3bd42762
23-3.module_el8.4.0+2522+3bd42762
c-ares
AlmaLinux:8
 before 1.13.0-6.el8
1.13.0-6.el8
c-ares-devel
AlmaLinux:8
 before 1.13.0-6.el8
1.13.0-6.el8
ceph
Azure Linux:3
 before 18.2.2-1
18.2.2-1
node
Bitnami
 12.0.0 up to 12.12.1, 12.13.0 up to 12.22.5, 14.0.0 up to 14.14.1, 14.15.0 up to 14.17.5, 16.0.0 up to 16.6.2
12.12.112.22.514.14.114.17.516.6.2
node-min
Bitnami
 12.0.0 up to 12.12.1, 12.13.0 up to 12.22.5, 14.0.0 up to 14.14.1, 14.15.0 up to 14.17.5, 16.0.0 up to 16.6.2
12.12.112.22.514.14.114.17.516.6.2
pgbouncer
Bitnami
 before 1.17.1
1.17.1
c-ares
Debian:12
 before 1.17.1-1.1
1.17.1-1.1
c-ares
Debian:13
 before 1.17.1-1.1
1.17.1-1.1
c-ares
Debian:14
 before 1.17.1-1.1
1.17.1-1.1
c-ares
Debian:9
 before 1.12.0-1+deb9u2, plus listed versions
1.12.0-11.12.0-1+deb9u1
1.12.0-1+deb9u2
c-ares
Debian:10
 before 1.14.0-1+deb10u1, plus listed versions
1.14.0-1
1.14.0-1+deb10u1
c-ares
Mageia:8
 before 1.17.1-1.1.mga8
1.17.1-1.1.mga8
nodejs
Mageia:8
From an advisory covering 9 CVEs
 before 14.17.6-1.mga8
14.17.6-1.mga8
c-ares
openEuler:20.03-LTS-SP1
 before 1.16.1-3.oe1
1.16.1-3.oe1
c-ares
openEuler:20.03-LTS-SP2
 before 1.16.1-3.oe1
1.16.1-3.oe1
rh-nodejs14-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:2.0.3-5.el7
0:2.0.3-5.el7
rh-nodejs14-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:14.17.5-1.el7
0:14.17.5-1.el7
rh-nodejs14-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:6.14.14-14.17.5.1.el7
0:6.14.14-14.17.5.1.el7
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:12.22.5-1.el7
0:12.22.5-1.el7
rh-nodejs12-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:2.0.3-5.el7
0:2.0.3-5.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:6.14.14-12.22.5.1.el7
0:6.14.14-12.22.5.1.el7
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7
1:12.22.5-1.module+el8.4.0+12242+af52a4c7
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:2.0.3-1.module+el8.4.0+11732+c668cc9f
0:2.0.3-1.module+el8.4.0+11732+c668cc9f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7
1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7
nodejs
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-debuginfo
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-debugsource
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-devel
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-docs
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-full-i18n
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-nodemon
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b
1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b
nodejs
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-debuginfo
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-debugsource
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-devel
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-docs
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-full-i18n
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-nodemon
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec
1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+12247+e2879e58
1:14.17.5-1.module+el8.4.0+12247+e2879e58
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:2.0.3-1.module+el8.3.0+6519+9f98ed83
0:2.0.3-1.module+el8.3.0+6519+9f98ed83
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:23-3.module+el8.3.0+6519+9f98ed83
0:23-3.module+el8.3.0+6519+9f98ed83
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58
1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58
c-ares
Red Hat:enterprise_linux:8::baseos
 before 0:1.13.0-6.el8
0:1.13.0-6.el8
c-ares-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.13.0-6.el8
0:1.13.0-6.el8
c-ares-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:1.13.0-6.el8
0:1.13.0-6.el8
c-ares-devel
Red Hat:enterprise_linux:8::baseos
 before 0:1.13.0-6.el8
0:1.13.0-6.el8
nodejs
Rocky Linux:8
From an advisory covering 8 CVEs
 before 1:12.22.5-1.module+el8.4.0+647+e905fa21
1:12.22.5-1.module+el8.4.0+647+e905fa21
nodejs-nodemon
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:2.0.3-1.module+el8.6.0+982+9fdca2d4
0:2.0.3-1.module+el8.6.0+982+9fdca2d4
nodejs-nodemon
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:2.0.3-1.module+el8.3.0+100+234774f7
0:2.0.3-1.module+el8.3.0+100+234774f7
nodejs-nodemon
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:2.0.3-1.module+el8.4.0+638+5344c6f7
0:2.0.3-1.module+el8.4.0+638+5344c6f7
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
nodejs
Rocky Linux:8
From an advisory covering 8 CVEs
 before 1:14.17.5-1.module+el8.4.0+654+17ff1d38
1:14.17.5-1.module+el8.4.0+654+17ff1d38
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:23-3.module+el8.7.0+1071+4bdda2a8
0:23-3.module+el8.7.0+1071+4bdda2a8
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:23-3.module+el8.3.0+100+234774f7
0:23-3.module+el8.3.0+100+234774f7
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
 before 0:23-3.module+el8.5.0+733+de4fee6c
0:23-3.module+el8.5.0+733+de4fee6c
c-ares
Rocky Linux:8
 before 0:1.13.0-6.el8
0:1.13.0-6.el8
libcares2
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 1.7.4-7.10.3.1
1.7.4-7.10.3.1
libcares2
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.7.4-7.10.3.1
1.7.4-7.10.3.1
libcares2
SUSE:HPE Helion OpenStack 8
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:OpenStack Cloud 8
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:OpenStack Cloud 9
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:OpenStack Cloud Crowbar 8
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:OpenStack Cloud Crowbar 9
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:Linux Enterprise Server 12 SP5
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.9.1-9.7.1
1.9.1-9.7.1
libcares2
SUSE:Linux Enterprise Workstation Extension 12 SP5
 before 1.9.1-9.7.1
1.9.1-9.7.1
c-ares
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Linux Enterprise Server 15-LTSS
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Linux Enterprise Server for SAP Applications 15
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Manager Proxy 4.0
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Manager Retail Branch Server 4.0
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Manager Server 4.0
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
c-ares
SUSE:Enterprise Storage 6
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 4 CVEs
 before 10.24.1-1.42.2
10.24.1-1.42.2
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 5 CVEs
 before 12.22.5-1.35.1
12.22.5-1.35.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 5 CVEs
 before 12.22.5-4.19.1
12.22.5-4.19.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 5 CVEs
 before 12.22.5-4.19.1
12.22.5-4.19.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 4 CVEs
 before 10.24.1-1.39.2
10.24.1-1.39.2
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 5 CVEs
 before 14.17.5-6.15.3
14.17.5-6.15.3
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 5 CVEs
 before 14.17.5-5.15.5
14.17.5-5.15.5
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 5 CVEs
 before 14.17.5-5.15.5
14.17.5-5.15.5
c-ares
Ubuntu:Pro:16.04:LTS
 before 1.10.0-3ubuntu0.2+esm1, plus listed versions
1.10.0-21.10.0-31.10.0-3ubuntu0.11.10.0-3ubuntu0.2
1.10.0-3ubuntu0.2+esm1
c-ares
Ubuntu:18.04:LTS
 before 1.14.0-1ubuntu0.1, plus listed versions
1.13.0-21.13.0-31.14.0-1
1.14.0-1ubuntu0.1
c-ares
Ubuntu:20.04:LTS
 before 1.15.0-1ubuntu0.1, plus listed versions
1.15.0-1build1
1.15.0-1ubuntu0.1
c-ares
Ubuntu:22.04:LTS
 before 1.17.1-1ubuntu1
1.17.1-1ubuntu1
c-ares
openSUSE:Leap 15.2
 before 1.17.1+20200724-lp152.2.9.1
1.17.1+20200724-lp152.2.9.1
c-ares-tests
openSUSE:Leap 15.2
 before 1.17.1+20200724-lp152.2.9.1
1.17.1+20200724-lp152.2.9.1
nodejs12
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 12.22.5-lp152.3.18.1
12.22.5-lp152.3.18.1
nodejs10
openSUSE:Leap 15.2
From an advisory covering 4 CVEs
 before 10.24.1-lp152.2.18.1
10.24.1-lp152.2.18.1
nodejs14
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 14.17.5-lp152.14.1
14.17.5-lp152.14.1
c-ares
openSUSE:Leap 15.3
 before 1.17.1+20200724-3.14.1
1.17.1+20200724-3.14.1
nodejs12
openSUSE:Leap 15.3
From an advisory covering 5 CVEs
 before 12.22.5-4.19.1
12.22.5-4.19.1
nodejs10
openSUSE:Leap 15.3
From an advisory covering 4 CVEs
 before 10.24.1-1.39.2
10.24.1-1.39.2
nodejs14
openSUSE:Leap 15.3
From an advisory covering 5 CVEs
 before 14.17.5-5.15.5
14.17.5-5.15.5
c-ares
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.17.2-2.2
1.17.2-2.2
nodejs14
openSUSE:Tumbleweed
From an advisory covering 19 CVEs
 before 14.17.5-1.2
14.17.5-1.2
nodejs16
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 16.6.2-2.2
16.6.2-2.2

History

History
RecordedChangedSources
affected
factsOSV
affectedOSV
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3672 is a medium vulnerability (CVSS 5.6) in C-ares, published August 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.81%, the 86th percentile. Fixed in c-ares 1.17.2-r0.

References

Show 160 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open