Skip to content
OpenAdvisories
Low ALAS2-2020-1502 1 CVE

Low: avahi security update (Amazon Linux 2)

Published Oct 22, 2020 · Updated Oct 22, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-6519: avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809. 1426712: CVE-2017-6519 avahi: Multicast DNS responds to unicast queries outside of local network

Fixed packages 23

ReleasePackageFixed in
Amazon Linux · 2 avahi 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-autoipd 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-compat-howl 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-compat-howl-devel 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-compat-libdns_sd 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-compat-libdns_sd-devel 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-debuginfo 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-devel 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-dnsconfd 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-glib 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-glib-devel 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-gobject 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-gobject-devel 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-libs 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-qt3 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-qt3-devel 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-qt4 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-qt4-devel 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-tools 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-ui 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-ui-devel 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-ui-gtk3 0:0.6.31-20.amzn2
Amazon Linux · 2 avahi-ui-tools 0:0.6.31-20.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-6519.html