c-ares: Denial of service — GLSA 202012-11

A Denial of Service vulnerability was discovered in c-ares.

Affected packages

net-dns/c-ares on all architectures
Affected versions < 1.17.1
Unaffected versions >= 1.17.1

Background

c-ares is an asynchronous resolver library.

Description

It was discovered that c-ares incorrectly handled certain DNS requests.

Impact

A remote attacker, able to trigger a DNS request for a host of their choice by an application linked against c-ares, could possibly cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All c-ares users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-dns/c-ares-1.17.1"
 

References

Release date
December 23, 2020

Latest revision
December 23, 2020: 1

Severity
low

Exploitable
local, remote

Bugzilla entries