Bug 1898554 (CVE-2020-8277)

Summary:	CVE-2020-8277 c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	atikhono, hhorak, jhrozek, jorton, nagy.martin, nodejs-maint, spotrh, valtri, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	c-ares 1.17.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-12-01 17:33:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1898556, 1898557, 1898558, 1898559, 1898561, 1898562, 1898598, 1898600, 1898601, 1898602, 1901046, 1916387, 1917856
Bug Blocks:	1898560

Description Guilherme de Almeida Suckevicz 2020-11-17 14:12:00 UTC

Denial of Service through DNS request (High). A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses.

Reference:
https://github.com/c-ares/c-ares/issues/371

Upstream patch:
https://github.com/c-ares/c-ares/commit/0d252eb3b2147179296a3bdb4ef97883c97c54d3

Comment 1 Guilherme de Almeida Suckevicz 2020-11-17 14:12:51 UTC

Created c-ares tracking bugs for this issue:

Affects: fedora-all [bug 1898556]


Created mingw-c-ares tracking bugs for this issue:

Affects: fedora-all [bug 1898557]


Created nodejs:11/c-ares tracking bugs for this issue:

Affects: fedora-all [bug 1898558]


Created nodejs:12/c-ares tracking bugs for this issue:

Affects: fedora-all [bug 1898559]


Created nodejs:13/c-ares tracking bugs for this issue:

Affects: fedora-all [bug 1898561]


Created nodejs:14/c-ares tracking bugs for this issue:

Affects: fedora-all [bug 1898562]

Comment 6 errata-xmlrpc 2020-12-01 14:47:16 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2020:5305 https://access.redhat.com/errata/RHSA-2020:5305

Comment 7 Product Security DevOps Team 2020-12-01 17:33:57 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-8277

Comment 8 errata-xmlrpc 2020-12-15 17:09:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:5499 https://access.redhat.com/errata/RHSA-2020:5499

Comment 9 errata-xmlrpc 2021-02-04 17:18:04 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:0421 https://access.redhat.com/errata/RHSA-2021:0421

Comment 10 errata-xmlrpc 2021-02-16 14:33:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0551 https://access.redhat.com/errata/RHSA-2021:0551