gpp_maybe Security update for c-ares

SUSE-SLE-Module-Basesystem-15-SP2-2021-2760

This update for c-ares fixes the following issues: Version update to git snapshot 1.17.1+20200724: - CVE-2021-3672: fixed missing input validation on hostnames returned by DNS servers (bsc#1188881) - If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause crash - Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response - Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing - Use unbuffered /dev/urandom for random data to prevent early startup performance issues

• Release Date
  Aug 17 2021
• References
  Bugzilla: 1188881
  CVEs: CVE-2021-3672
• Type
  security
• Severity
  important

cloud_download Downloads

Basesystem Module 15.2 s390x

• Packages
  c-ares
  Library for asynchronous name resolves

  1.17.1+20200724-3.14.1 lock src

  c-ares-devel
  Development files for c-ares

  1.17.1+20200724-3.14.1 lock rpm

  libcares2
  Library for asynchronous name resolves

  1.17.1+20200724-3.14.1 lock rpm

Basesystem Module 15.2 ppc64le

• Packages
  c-ares
  Library for asynchronous name resolves

  1.17.1+20200724-3.14.1 lock src

  c-ares-devel
  Development files for c-ares

  1.17.1+20200724-3.14.1 lock rpm

  libcares2
  Library for asynchronous name resolves

  1.17.1+20200724-3.14.1 lock rpm

Basesystem Module 15.2 aarch64

• Packages
  c-ares
  Library for asynchronous name resolves

  1.17.1+20200724-3.14.1 lock src

  c-ares-devel
  Development files for c-ares

  1.17.1+20200724-3.14.1 lock rpm

  libcares2
  Library for asynchronous name resolves

  1.17.1+20200724-3.14.1 lock rpm

Basesystem Module 15.2 x86_64

• Packages
  c-ares
  Library for asynchronous name resolves

  1.17.1+20200724-3.14.1 lock src

  c-ares-devel
  Development files for c-ares

  1.17.1+20200724-3.14.1 lock rpm

  libcares2
  Library for asynchronous name resolves

  1.17.1+20200724-3.14.1 lock rpm