ASA-202108-13 log generated external raw

[ASA-202108-13] c-ares: insufficient validation
Arch Linux Security Advisory ASA-202108-13 ========================================== Severity: Medium Date : 2021-08-10 CVE-ID : CVE-2021-3672 Package : c-ares Type : insufficient validation Remote : Yes Link : Summary ======= The package c-ares before version 1.17.2-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1.17.2-1. # pacman -Syu "c-ares>=1.17.2-1" The problem has been fixed upstream in version 1.17.2. Workaround ========== None. Description =========== Missing input validation of host names returned by Domain Name Servers in the c-ares library before version 1.17.2 can lead to output of wrong hostnames (leading to domain hijacking). Impact ====== A remote attacker with the ability to create DNS entries could create crafted entries that output the wrong hostname when resolved with c-ares, leading to potential domain hijacking. References ==========