Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-52616: avahi: Avahi Wide-Area DNS Predictable Transaction IDs CVE-2024-52615: avahi: Avahi Wide-Area DNS Uses Constant Source Port
Fixed packages 23
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | avahi | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-autoipd | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-compat-howl | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-compat-howl-devel | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-compat-libdns_sd | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-compat-libdns_sd-devel | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-debuginfo | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-devel | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-dnsconfd | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-glib | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-glib-devel | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-gobject | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-gobject-devel | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-libs | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-qt3 | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-qt3-devel | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-qt4 | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-qt4-devel | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-tools | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-ui | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-ui-devel | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-ui-gtk3 | 0:0.6.31-20.amzn2.0.7 |
| Amazon Linux · 2 | avahi-ui-tools | 0:0.6.31-20.amzn2.0.7 |
Vulnerabilities 2
-
Medium 5.3
Avahi: avahi wide-area dns uses constant source port
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
-
Medium 5.3
Avahi: avahi wide-area dns predictable transaction ids
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.