Cross-site scripting in c-ares
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 7 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.
Summary
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02814 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 7 advisoriesRed Hat: 7 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | c-ares | c-ares 1.17.2 | — | No fix listed | CNA |
- c-ares Vendor— Affected c-ares 1.17.2 Fixed in — No fix listed CNA
CPE configurations NVD · 35
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:* | 1.0.0 to before 1.17.2 | Vulnerable | C-ares Project |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.7:*:*:*:*:*:*:* | 7.7 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_computer_node:1:*:*:*:*:*:*:* | 1 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* | 7.7 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
- cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.17.2 Vulnerable ·C-ares Project
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_computer_node:1:*:*:*:*:*:*:* Versions 1 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
Show 25 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_tus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:1:*:*:*:*:*:*:* | 1 | Vulnerable | Red Hat |
| cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* | before 1.0.1.1 | Vulnerable | Siemens |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | 12.0.0 – 12.12.0 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | 12.13.0 to before 12.22.5 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | 14.0.0 – 14.14.0 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | 14.15.0 to before 14.17.5 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | 16.0.0 to before 16.6.2 | Vulnerable | NodeJS |
| cpe:2.3:a:pgbouncer:pgbouncer:*:*:*:*:*:*:*:* | up to 1.17.0 | Vulnerable | Pgbouncer |
- cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_tus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:1:*:*:*:*:*:*:* Versions 1 Vulnerable ·Red Hat
- cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* Versions before 1.0.1.1 Vulnerable ·Siemens
- cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 12.0.0 – 12.12.0 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 12.13.0 to before 12.22.5 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 14.0.0 – 14.14.0 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 14.15.0 to before 14.17.5 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 16.0.0 to before 16.6.2 Vulnerable ·NodeJS
- cpe:2.3:a:pgbouncer:pgbouncer:*:*:*:*:*:*:*:* Versions up to 1.17.0 Vulnerable ·Pgbouncer
Remediation
Red Hat 7 advisories
- RHSA-2022:2043 Released 2022-05-10 · Red Hat rating Moderatec-ares security update
- Red Hat Enterprise Linux BaseOS (v. 8) c-ares-1.13.0-6.el8, c-ares-devel-1.13.0-6.el8
- RHSA-2021:3666 Released 2021-09-27 · Red Hat rating Importantnodejs:14 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.17.5-1.module+el8.4.0+12247+e2879e58.aarch64::nodejs:14, nodejs-1:14.17.5-1.module+el8.4.0+12247+e2879e58.ppc64le::nodejs:14, nodejs-1:14.17.5-1.module+el8.4.0+12247+e2879e58.s390x::nodejs:14 +19
- RHSA-2021:3638 Released 2021-09-22 · Red Hat rating Importantnodejs:12 security and bug fix update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.aarch64::nodejs:12, nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.ppc64le::nodejs:12, nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.s390x::nodejs:12 +19
Show 4 more Red Hat advisories
- RHSA-2021:3639 Released 2021-09-22 · Red Hat rating Importantnodejs:12 security and bug fix update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.aarch64::nodejs:12, nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.ppc64le::nodejs:12, nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.s390x::nodejs:12 +19
- RHSA-2021:3623 Released 2021-09-21 · Red Hat rating Importantnodejs:12 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.22.5-1.module+el8.4.0+12242+af52a4c7.aarch64::nodejs:12, nodejs-1:12.22.5-1.module+el8.4.0+12242+af52a4c7.ppc64le::nodejs:12, nodejs-1:12.22.5-1.module+el8.4.0+12242+af52a4c7.s390x::nodejs:12 +19
- RHSA-2021:3280 Released 2021-08-26 · Red Hat rating Importantrh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-14.17.5-1.el7, rh-nodejs14-nodejs-devel-14.17.5-1.el7, rh-nodejs14-nodejs-docs-14.17.5-1.el7 +2
- RHSA-2021:3281 Released 2021-08-26 · Red Hat rating Importantrh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.22.5-1.el7, rh-nodejs12-nodejs-devel-12.22.5-1.el7, rh-nodejs12-nodejs-docs-12.22.5-1.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.22.5-1.el7, rh-nodejs12-nodejs-devel-12.22.5-1.el7, rh-nodejs12-nodejs-docs-12.22.5-1.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.22.5-1.el7, rh-nodejs12-nodejs-devel-12.22.5-1.el7, rh-nodejs12-nodejs-docs-12.22.5-1.el7 +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:3623, RHSA-2021:3666 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2021:3639 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | RHSA-2021:3638 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2022:2043 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3280, RHSA-2021:3281 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:3280, RHSA-2021:3281 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3280, RHSA-2021:3281 |
Not affected: 5 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3672
- 2026-10-03 Alias added: GHSA-hghm-3vc3-hppj
References
Sources
- CVE-2021-3672 · CVE Program
- CVE-2021-3672 · NVD
- FIRST EPSS
- GHSA-hghm-3vc3-hppj · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3672 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences