Avahi Security Update
Summary
ALSA-2023:6707: Moderate: avahi security update. Affects avahi versions < 0.8-15.el9. Fixed in 0.8-15.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network, allowing users to plug their computers into a network and easily discover and interact with other devices. Avahi is widely used for various networking tasks such as chatting, printing, and file sharing.
The Avahi package and Avahi-aware applications provide a seamless experience for users by automatically configuring network services without the need for manual configuration.
Vulnerability Detail
The Avahi package is affected by multiple security vulnerabilities:
-
CVE-2021-3468: This vulnerability allows a local Denial of Service (DoS) attack by causing the avahi-daemon to enter an event-busy-loop when writing long lines to the /run/avahi-daemon/socket file.
-
CVE-2021-3502: An assertion vulnerability exists in avahi_s_host_name_resolver_start, which can be triggered when attempting to resolve badly-formatted hostnames.
-
CVE-2023-1981: This vulnerability allows an attacker to crash the avahi-daemon via DBus.
These vulnerabilities can have various impacts, including service disruption, resource exhaustion, and potential remote code execution.
How To Fix
Minimum fixed version
0.8-15.el9
This is the first release that contains the fix.
sudo dnf update avahiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Avahi is a widely used package for Zero Configuration Networking. However, it is important to keep the package up to date to mitigate the risks associated with the identified vulnerabilities. To ensure the security of your system, update the Avahi package to version 0.8-15.el9 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for avahi →
FAQ
Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It allows users to easily discover and interact with network services on a local network.
These vulnerabilities can lead to service disruption, resource exhaustion, and potential remote code execution.
To fix these vulnerabilities, update the Avahi package to version 0.8-15.el9 or later using the package manager of your operating system.
No specific workarounds have been provided for these vulnerabilities. It is recommended to apply the security update as soon as possible.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for avahi.
