Skip to content
Fencer Vulns
medium 5.6

CVE-2021-3672 json

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to…

published 2021-11-23 4 y ago modified 2026-10-16 24 d ago also BIT-node-2021-3672 , BIT-node-min-2021-3672 , BIT-pgbouncer-2021-3672 , EUVD-2021-26964

cvss
5.6
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Patch / fix

  • bitnami node 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2
  • bitnami node-min 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2
  • bitnami pgbouncer 1.17.1
  • c-ares_project c-ares 1.17.2
  • siemens sinec_infrastructure_network_services 1.0.1.1
  • nodejs node.js 12.22.5, 14.17.5, 16.6.2
  • c-ares Debian 14, Debian 13, Debian 12 1.17.1-1.1

debian advisories DEBIAN-CVE-2021-3672

  • c-ares Ubuntu 18.04 LTS 1.14.0-1ubuntu0.1
  • c-ares Ubuntu 20.04 LTS 1.15.0-1ubuntu0.1
  • c-ares Ubuntu 22.04 LTS 1.17.1-1ubuntu1
  • c-ares Ubuntu Pro 16.04 LTS 1.10.0-3ubuntu0.2+esm1

ubuntu advisories UBUNTU-CVE-2021-3672

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • npm RHEL 8 1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58
  • nodejs RHEL 8 1:14.17.5-1.module+el8.4.0+12247+e2879e58
  • nodejs-nodemon RHEL 8 2.0.3-1.module+el8.3.0+6519+9f98ed83
  • nodejs-full-i18n RHEL 8 1:14.17.5-1.module+el8.4.0+12247+e2879e58
  • nodejs-packaging RHEL 8 23-3.module+el8.3.0+6519+9f98ed83
  • nodejs-packaging RHEL 8, RHEL 8.2 EUS, RHEL 8.1 EUS 17-3.module+el8.1.0+3369+37ae6a45
  • npm RHEL 8 1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7
  • nodejs RHEL 8 1:12.22.5-1.module+el8.4.0+12242+af52a4c7

red hat advisories RHSA-2021:3666RHSA-2021:3639RHSA-2021:3638RHSA-2021:3623RHSA-2021:3280RHSA-2021:3281

  • nodejs14 SLE Module for Web and Scripting 15 SP3, SLE Module for Web and Scripting 15 SP2 14.17.5-5.15.5
  • nodejs14 SLE Module for Web and Scripting 12 14.17.5-6.15.3
  • nodejs10 SLE Module for Web and Scripting 15 SP2 10.24.1-1.39.2
  • nodejs12 SLE Module for Web and Scripting 15 SP3, SLE Module for Web and Scripting 15 SP2 12.22.5-4.19.1
  • nodejs12 SLE Module for Web and Scripting 12 12.22.5-1.35.1
  • nodejs10 SLE Module for Web and Scripting 12 10.24.1-1.42.2
  • c-ares SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 1.17.1+20200724-3.14.1
  • libcares2 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +12 more 1.9.1-9.7.1

suse advisories SUSE-SU-2021:3211-1SUSE-SU-2021:3184-1SUSE-SU-2021:2953-1SUSE-SU-2021:2875-1SUSE-SU-2021:2824-1SUSE-SU-2021:2823-1

  • c-ares openSUSE Tumbleweed 1.17.2-2.2
  • nodejs14 openSUSE Tumbleweed 14.17.5-1.2
  • nodejs16 openSUSE Tumbleweed 16.6.2-2.2
  • nodejs14 openSUSE Leap 15.2 14.17.5-lp152.14.1
  • nodejs14 openSUSE Leap 15.3 14.17.5-5.15.5
  • nodejs10 openSUSE Leap 15.2 10.24.1-lp152.2.18.1
  • nodejs10 openSUSE Leap 15.3 10.24.1-1.39.2
  • nodejs12 openSUSE Leap 15.2 12.22.5-lp152.3.18.1

opensuse advisories openSUSE-SU-2024:10668-1openSUSE-SU-2024:11096-1openSUSE-SU-2024:11097-1openSUSE-SU-2021:1313-1openSUSE-SU-2021:3211-1openSUSE-SU-2021:1239-1

  • c-ares AlmaLinux 8 1.13.0-6.el8
  • nodejs-nodemon AlmaLinux 8 2.0.3-1.module_el8.4.0+2521+c668cc9f
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.5.0+254+b4526b16
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.4.0+2522+3bd42762
  • npm AlmaLinux 8 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7
  • npm AlmaLinux 8 1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441
  • nodejs AlmaLinux 8 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
  • nodejs AlmaLinux 8 1:12.22.5-1.module_el8.5.0+85+79a7b441

almalinux advisories ALSA-2022:2043ALSA-2021:3666ALSA-2021:3623

  • c-ares Rocky Linux 8 1.13.0-6.el8
  • nodejs Rocky Linux 8 1:14.17.5-1.module+el8.4.0+654+17ff1d38
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.6.0+982+9fdca2d4
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.3.0+100+234774f7
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.4.0+638+5344c6f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.5.0+733+de4fee6c

rocky linux advisories RLSA-2022:2043RLSA-2021:3666RLSA-2021:3623

  • c-ares Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 1.17.2-r0
  • nodejs Alpine 3.12, Alpine 3.11 12.22.5-r0
  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 14.17.5-r0
  • nodejs-current Alpine 3.14 16.11.1-r0
  • nodejs-current Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 16.6.2-r0

alpine advisories ALPINE-CVE-2021-3672

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ceph Azure Linux 3.0 18.2.2-1

azure linux advisories AZL-38359

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • c-ares Arch Linux 1.17.2-1

arch linux advisories AVG-2268

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3672 updated cvss 5.6

c-ares: Missing input validation of host names may lead to domain hijacking

  • Red Hat Enterprise Linux 6 c-ares Red Hat Enterprise Linux 7 c-ares
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 12.22.5-1.module+el8.4.0+12242+af52a4c7, nodejs 14.17.5-1.module+el8.4.0+12247+e2879e58, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.3-1.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.3-1.module+el8.4.0+11732+c668cc9f, +4 more
    fixed: vendor fix RHSA-2021:3623
  • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs 12.22.5-1.module+el8.1.0+12238+63fe3aec, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, npm 6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec, nodejs-full-i18n 12.22.5-1.module+el8.1.0+12238+63fe3aec
    fixed: vendor fix RHSA-2021:3639
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) nodejs 12.22.5-1.module+el8.2.0+12241+a3db445b, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, npm 6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b, nodejs-full-i18n 12.22.5-1.module+el8.2.0+12241+a3db445b
    fixed: vendor fix RHSA-2021:3638
  • Red Hat Enterprise Linux BaseOS (v. 8) c-ares 1.13.0-6.el8
    fixed: vendor fix RHSA-2022:2043
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs12-npm 6.14.14-12.22.5.1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7, rh-nodejs12-nodejs-nodemon 2.0.3-5.el7
    fixed: vendor fix RHSA-2021:3281
  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 c-ares Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-nodemon 2.0.3-5.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-nodemon 2.0.3-5.el7
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

2.81% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • c-ares.haxx.se https://c-ares.haxx.se/adv_20210810.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
OSV 3.1 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
bitnami node
>=12.0.0, <12.12.1
>=12.13.0, <12.22.5
>=14.0.0, <14.14.1
>=14.15.0, <14.17.5
>=16.0.0, <16.6.2
12.12.1
12.22.5
14.14.1
14.17.5
16.6.2
bitnami node-min
>=12.0.0, <12.12.1
>=12.13.0, <12.22.5
>=14.0.0, <14.14.1
>=14.15.0, <14.17.5
>=16.0.0, <16.6.2
12.12.1
12.22.5
14.14.1
14.17.5
16.6.2
bitnami pgbouncer
<1.17.1
1.17.1

Affected products

  • n/a c-ares

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.