c-ares-1.13.0-6.el8.ML.1

The c-ares C library defines asynchronous DNS (Domain Name System) requests and
provides name resolving API.

Security Fix(es):

* c-ares: Missing input validation of host names may lead to domain hijacking
(CVE-2021-3672)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise
Linux 8.6 Release Notes linked from the References section.

CVE-2021-3672
A flaw was found in c-ares library, where a missing input validation check of
host names returned by DNS (Domain Name Servers) can lead to output of wrong
hostnames which might potentially lead to Domain Hijacking. The highest threat
from this vulnerability is to confidentiality and integrity as well as system
availability.