USN-5034-1: c-ares vulnerability

Releases

• Ubuntu 21.04
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• c-ares - library for asynchronous name resolution

Details

Philipp Jeitner and Haya Shulman discovered that c-ares incorrectly
validated certain hostnames returned by DNS servers. A remote attacker
could possibly use this issue to perform Domain Hijacking attacks.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 21.04

• libc-ares2 - 1.17.1-1ubuntu0.1

Ubuntu 20.04

• libc-ares2 - 1.15.0-1ubuntu0.1

Ubuntu 18.04

• libc-ares2 - 1.14.0-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-3672

Related notices

• USN-5034-2: libc-ares-dev, c-ares, libc-ares2