A c-ares security update has been released for Debian GNU/Linux 8 Extended LTS to address a missing input validation of host names.
ELA-474-1 c-ares security update
Package c-ares
ELA-474-1 c-ares security update
Version 1.10.0-2+deb8u3
Related CVEs CVE-2021-3672
An issue has been found in c-ares, an asynchronous name resolver. Missing input validation of host names returned by Domain Name Servers can lead to output of wrong hostnames.
For Debian 8 jessie, these problems have been fixed in version 1.10.0-2+deb8u3.
We recommend that you upgrade your c-ares packages.
Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/
