1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 4954-1] c-ares security update

    From Salvatore Bonaccorso@21:1/5 to All on Tue Aug 10 09:20:02 2021
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-4954-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso August 10, 2021 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : c-ares
    CVE ID : CVE-2021-3672
    Debian Bug : 992053

    Philipp Jeitner and Haya Shulman discovered a flaw in c-ares, a library
    that performs DNS requests and name resolution asynchronously. Missing
    input validation of hostnames returned by DNS servers can lead to output
    of wrong hostnames (leading to Domain Hijacking).

    For the stable distribution (buster), this problem has been fixed in
    version 1.14.0-1+deb10u1.

    We recommend that you upgrade your c-ares packages.

    For the detailed security status of c-ares please refer to its security
    tracker page at:
    https://security-tracker.debian.org/tracker/c-ares

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmESJlRfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0Qhug/+Kthvp5b6CBZvbB9SM044bEIBql24NaDggOG1B5VXnG7Mz4yCPpWAI8aE jjpV5tDsdRvPeavtbOaDyS65CV7ksCe3O1X8dWnyAl8sJRPSHNL0XoHK/kgQiatW bznzJvQulli4ZMYGKzfEbfre/BrYBztED6MM3deUKIv5YUik6B9yGloLZ5+pnyzj JN3UMRUK21lZAviQiH+mNl0hyr5We+NpzKkQz0WQhRFAnuEXGTbICt+WPEQdRHQh 0SwfL5ff9O8VzrnNKPIYii1i50/V9eRkUbgY0G28IbcBtioI7ll1Y6DEzIs6xEcl GVEBTY7UStXy/jvS/9XNrQ38gqCBQuXm1BYRlE9R+X6s90U7Y1HWOlRU3q2vOI91 DZzEUBxK0ramdd+B7TxSspV7jnmdSXixh8zLx49y7Ib6X8Y/3YgHRdED/0DvVZCI fcZnCN6UIKCm7FMD6ZvPBq2ILzqiHkK9bMVGCMeoATTF3Q/btIQGuJL6g70OMfAB FNd3mYOQcogLqxCkeGKf8w7sC9VKUIUHnI6f1s38IBrNWdjMOf2dKuxJk0siomr3 kyJ00RzclEObuaFVBDExz1LRCADrh/pkXGkh6lzlrOfB5oFqdNqBV3IQmdwC9LvA uwtRmtn0bRRCHcnkr5RmqslsbsGgehL9pfBCa6bkngLf8dxSW2I=
    =3rTj
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)