Bug 754939 – <net-dns/c-ares-1.17.1: Denial of service (CVE-2020-8277)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2020-11-16 16:52:26 UTC]

See tracker bug.

Bug: https://github.com/c-ares/c-ares/issues/371
Patch: https://github.com/c-ares/c-ares/commit/0d252eb3b2147179296a3bdb4ef97883c97c54d3

[Comment 1 Marek Szuba 2020-11-18 13:19:44 UTC]

Fixed upstream in 1.17.0, which incidentally is what we would need in the tree in order to be able to package nodejs-v15.

[Comment 2 Sam James 2020-11-18 15:56:45 UTC]

@blueness, able to bump?

[Comment 3 Anthony Basile 2020-11-20 19:46:38 UTC]

(In reply to Sam James from comment #2)
> @blueness, able to bump?

1.17.1 is on the tree

[Comment 4 Anthony Basile 2020-11-20 19:48:49 UTC]

@arches, please proceed with stabilization

KEYWORDS="amd64 arm arm64 hppa ppc ppc64 s390 sparc x86"

[Comment 5 Sam James 2020-11-20 23:43:21 UTC]

x86 done

[Comment 6 Sam James 2020-11-20 23:43:37 UTC]

amd64 done

[Comment 7 Sam James 2020-11-20 23:43:55 UTC]

arm done

[Comment 8 Sam James 2020-11-20 23:44:13 UTC]

arm64 done

[Comment 9 Sam James 2020-11-23 00:48:36 UTC]

sparc done

[Comment 10 Sam James 2020-11-23 01:24:49 UTC]

ppc done

[Comment 11 Sam James 2020-11-23 01:25:07 UTC]

ppc64 done

[Comment 12 Agostino Sarubbo 2020-11-24 07:43:41 UTC]

s390 stable

[Comment 13 Sergei Trofimovich (RETIRED) 2020-11-26 23:14:52 UTC]

hppa stable

[Comment 14 John Helmert III 2020-11-26 23:26:43 UTC]

All arches done. Maintainer, please cleanup.

[Comment 15 GLSAMaker/CVETool Bot 2020-12-23 20:19:34 UTC]

This issue was resolved and addressed in
 GLSA 202012-11 at https://security.gentoo.org/glsa/202012-11
by GLSA coordinator Thomas Deutschmann (whissi).