Bug 754936 (CVE-2020-8277)

Summary:	[Tracker] c-ares: Denial of Service with malicious DNS record (CVE-2020-8277)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:	754939, 754942
Bug Blocks:

Description Sam James archtester

2020-11-16 16:51:27 UTC

Noticed after the nodejs security release:
"CVE-2020-8277: Denial of Service through DNS request (High). A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses."

Bug: https://github.com/c-ares/c-ares/issues/371
Patch: https://github.com/c-ares/c-ares/commit/0d252eb3b2147179296a3bdb4ef97883c97c54d3