Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-52616: avahi: Avahi Wide-Area DNS Predictable Transaction IDs CVE-2024-52615: avahi: Avahi Wide-Area DNS Uses Constant Source Port
Fixed packages 27
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | avahi | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-autoipd | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-autoipd-debuginfo | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-compat-howl | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-compat-howl-debuginfo | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-compat-howl-devel | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-compat-libdns_sd | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-compat-libdns_sd-debuginfo | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-compat-libdns_sd-devel | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-debuginfo | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-debugsource | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-devel | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-dnsconfd | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-dnsconfd-debuginfo | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-glib | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-glib-debuginfo | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-glib-devel | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-gobject | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-gobject-debuginfo | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-gobject-devel | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-libs | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-libs-debuginfo | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-tools | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-tools-debuginfo | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-ui-devel | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-ui-gtk3 | 0:0.8-14.amzn2023.0.14 |
| Amazon Linux · 2023 | avahi-ui-gtk3-debuginfo | 0:0.8-14.amzn2023.0.14 |
Vulnerabilities 2
-
Medium 5.3
Avahi: avahi wide-area dns uses constant source port
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
-
Medium 5.3
Avahi: avahi wide-area dns predictable transaction ids
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.