USN-5034-1: c-ares vulnerability
10 August 2021
c-ares could be made to return wrong domains.
- c-ares - library for asynchronous name resolution
Philipp Jeitner and Haya Shulman discovered that c-ares incorrectly
validated certain hostnames returned by DNS servers. A remote attacker
could possibly use this issue to perform Domain Hijacking attacks.
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.
- USN-5034-2: libc-ares-dev, c-ares, libc-ares2