[SUSE-SU-2021:2760-1] Security update for c-ares

Severity Important

Affected Packages 16

CVEs 1

Security update for c-ares

This update for c-ares fixes the following issues:

Version update to git snapshot 1.17.1+20200724:

CVE-2021-3672: fixed missing input validation on hostnames returned by DNS servers (bsc#1188881)
If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause crash
Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response
Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing
Use unbuffered /dev/urandom for random data to prevent early startup performance issues

Package	Affected Version
pkg:rpm/suse/libcares2?arch=x86_64&distro=sles-15&sp=1	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/libcares2?arch=x86_64&distro=sles-15	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/libcares2?arch=s390x&distro=sles-15&sp=1	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/libcares2?arch=s390x&distro=sles-15	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/libcares2?arch=ppc64le&distro=sles-15&sp=1	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/libcares2?arch=ppc64le&distro=sles-15	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/libcares2?arch=aarch64&distro=sles-15&sp=1	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/libcares2?arch=aarch64&distro=sles-15	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/c-ares-devel?arch=x86_64&distro=sles-15&sp=1	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/c-ares-devel?arch=x86_64&distro=sles-15	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/c-ares-devel?arch=s390x&distro=sles-15&sp=1	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/c-ares-devel?arch=s390x&distro=sles-15	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/c-ares-devel?arch=ppc64le&distro=sles-15&sp=1	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/c-ares-devel?arch=ppc64le&distro=sles-15	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/c-ares-devel?arch=aarch64&distro=sles-15&sp=1	< 1.17.1+20200724-3.14.1
pkg:rpm/suse/c-ares-devel?arch=aarch64&distro=sles-15	< 1.17.1+20200724-3.14.1

ID

SUSE-SU-2021:2760-1

Severity

important

URL

https://www.suse.com/support/update/announcement/2021/suse-su-20212760-1/

Published

2021-08-17T15:12:07
(3 years ago)

Modified

2021-08-17T15:12:07
(3 years ago)

Rights

Other Advisories

Source	Name	URL
Suse	SUSE ratings	https://www.suse.com/support/security/rating/
Suse	URL of this CSAF notice	https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_2760-1.json
Suse	URL for SUSE-SU-2021:2760-1	https://www.suse.com/support/update/announcement/2021/suse-su-20212760-1/
Suse	E-Mail link for SUSE-SU-2021:2760-1	https://lists.suse.com/pipermail/sle-updates/2021-August/019883.html
Bugzilla	SUSE Bug 1188881	https://bugzilla.suse.com/1188881
CVE	SUSE CVE CVE-2021-3672 page	https://www.suse.com/security/cve/CVE-2021-3672/

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch
Affected	pkg:rpm/suse/libcares2?arch=x86_64&distro=sles-15&sp=1	suse	libcares2	< 1.17.1+20200724-3.14.1	sles-15	x86_64
Affected	pkg:rpm/suse/libcares2?arch=x86_64&distro=sles-15	suse	libcares2	< 1.17.1+20200724-3.14.1	sles-15	x86_64
Affected	pkg:rpm/suse/libcares2?arch=s390x&distro=sles-15&sp=1	suse	libcares2	< 1.17.1+20200724-3.14.1	sles-15	s390x
Affected	pkg:rpm/suse/libcares2?arch=s390x&distro=sles-15	suse	libcares2	< 1.17.1+20200724-3.14.1	sles-15	s390x
Affected	pkg:rpm/suse/libcares2?arch=ppc64le&distro=sles-15&sp=1	suse	libcares2	< 1.17.1+20200724-3.14.1	sles-15	ppc64le
Affected	pkg:rpm/suse/libcares2?arch=ppc64le&distro=sles-15	suse	libcares2	< 1.17.1+20200724-3.14.1	sles-15	ppc64le
Affected	pkg:rpm/suse/libcares2?arch=aarch64&distro=sles-15&sp=1	suse	libcares2	< 1.17.1+20200724-3.14.1	sles-15	aarch64
Affected	pkg:rpm/suse/libcares2?arch=aarch64&distro=sles-15	suse	libcares2	< 1.17.1+20200724-3.14.1	sles-15	aarch64
Affected	pkg:rpm/suse/c-ares-devel?arch=x86_64&distro=sles-15&sp=1	suse	c-ares-devel	< 1.17.1+20200724-3.14.1	sles-15	x86_64
Affected	pkg:rpm/suse/c-ares-devel?arch=x86_64&distro=sles-15	suse	c-ares-devel	< 1.17.1+20200724-3.14.1	sles-15	x86_64
Affected	pkg:rpm/suse/c-ares-devel?arch=s390x&distro=sles-15&sp=1	suse	c-ares-devel	< 1.17.1+20200724-3.14.1	sles-15	s390x
Affected	pkg:rpm/suse/c-ares-devel?arch=s390x&distro=sles-15	suse	c-ares-devel	< 1.17.1+20200724-3.14.1	sles-15	s390x
Affected	pkg:rpm/suse/c-ares-devel?arch=ppc64le&distro=sles-15&sp=1	suse	c-ares-devel	< 1.17.1+20200724-3.14.1	sles-15	ppc64le
Affected	pkg:rpm/suse/c-ares-devel?arch=ppc64le&distro=sles-15	suse	c-ares-devel	< 1.17.1+20200724-3.14.1	sles-15	ppc64le
Affected	pkg:rpm/suse/c-ares-devel?arch=aarch64&distro=sles-15&sp=1	suse	c-ares-devel	< 1.17.1+20200724-3.14.1	sles-15	aarch64
Affected	pkg:rpm/suse/c-ares-devel?arch=aarch64&distro=sles-15	suse	c-ares-devel	< 1.17.1+20200724-3.14.1	sles-15	aarch64

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date