USN-5034-1: c-ares vulnerability
10 August 2021
c-ares could be made to return wrong domains.
Releases
Packages
- c-ares - library for asynchronous name resolution
Details
Philipp Jeitner and Haya Shulman discovered that c-ares incorrectly
validated certain hostnames returned by DNS servers. A remote attacker
could possibly use this issue to perform Domain Hijacking attacks.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 21.04
Ubuntu 20.04
Ubuntu 18.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-5034-2: libc-ares-dev, c-ares, libc-ares2