CVE-2021-3672: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

November 23, 2021 (updated January 5, 2024)

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

References

bugzilla.redhat.com/show_bug.cgi?id=1988342
c-ares.haxx.se/adv_20210810.html
nvd.nist.gov/vuln/detail/CVE-2021-3672

Code Behaviors & Features

Detect and mitigate CVE-2021-3672 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →