Critical Assertion Vulnerability in Avahi Package
Summary
ALPINE-CVE-2023-38471: A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. Affects avahi versions < 0.8-r15. Fixed in 0.8-r15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Avahi is an open-source implementation of the Zeroconf protocol, enabling automatic discovery of network services. It is widely used in various Linux distributions, including Alpine Linux. The package facilitates seamless communication between devices on a local network without requiring manual configuration. However, a recent vulnerability has been identified that could potentially compromise the integrity of systems utilizing this package.
Vulnerability Detail
A vulnerability has been discovered in the Avahi package, specifically within the dbus_set_host_name function. This issue arises from a reachable assertion, which can lead to unexpected behavior or crashes in applications relying on this functionality. The vulnerability is classified under CVE-2023-38471 and has a CVSS score of 5.5, indicating a moderate severity level. If exploited, this vulnerability could disrupt service availability and affect the overall stability of the affected systems.
How To Fix
Minimum fixed version
0.8-r15
This is the first release that contains the fix.
sudo apk add --upgrade avahiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Avahi service until the package is updated. This can be achieved by running the following command:
rc-service avahi-daemon stop
This will halt the Avahi service, reducing the risk of exploitation until a proper fix is applied.
Conclusion
The Avahi package has a critical vulnerability (CVE-2023-38471) that could affect the stability of systems using it. Users are advised to update to the fixed version 0.8-r15 or later to mitigate this risk. In the meantime, disabling the service can serve as a temporary measure to protect against potential exploitation.
See every vulnerability recorded for avahi →
FAQ
CVE-2023-38471 is a vulnerability found in the Avahi package that involves a reachable assertion in the dbus_set_host_name function, potentially leading to application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability has a CVSS score of 5.5, indicating a moderate level of severity that could impact service availability.
Yes, a patched version of the Avahi package (0.8-r15 or later) is available. Users should update to this version to mitigate the vulnerability.
If immediate updates are not possible, consider stopping the Avahi service as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for avahi.
