ALSA-2024:2433 — Moderate: avahi security update

Summary

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers.

Security Fix(es):

* avahi: Reachable assertion in avahi_dns_packet_append_record (CVE-2023-38469)
* avahi: Reachable assertion in avahi_escape_label (CVE-2023-38470)
* avahi: Reachable assertion in dbus_set_host_name (CVE-2023-38471)
* avahi: Reachable assertion in avahi_rdata_parse (CVE-2023-38472)
* avahi: Reachable assertion in avahi_alternative_host_name (CVE-2023-38473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 10

Release	Package	Fixed in
AlmaLinux · 9	avahi	0.8-20.el9
AlmaLinux · 9	avahi-compat-howl	0.8-20.el9
AlmaLinux · 9	avahi-compat-howl-devel	0.8-20.el9
AlmaLinux · 9	avahi-compat-libdns_sd	0.8-20.el9
AlmaLinux · 9	avahi-compat-libdns_sd-devel	0.8-20.el9
AlmaLinux · 9	avahi-devel	0.8-20.el9
AlmaLinux · 9	avahi-glib	0.8-20.el9
AlmaLinux · 9	avahi-glib-devel	0.8-20.el9
AlmaLinux · 9	avahi-libs	0.8-20.el9
AlmaLinux · 9	avahi-tools	0.8-20.el9

Vulnerabilities 5

Medium 6.2

CVE-2023-38469

Reachable assertion in avahi_dns_packet_append_record

A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.

Red Hat Fedora avahi Red Hat Enterprise Linux 9 Linux Debian Ubuntu Azure Linux Alpine Wolfi

Nov 2, 2023
Medium 6.2

CVE-2023-38470

Reachable assertion in avahi_escape_label

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.

Red Hat Fedora avahi Red Hat Enterprise Linux 9 Linux Debian Ubuntu Azure Linux Alpine Wolfi

Nov 2, 2023
Medium 6.2

CVE-2023-38471

Reachable assertion in dbus_set_host_name

A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.

Red Hat Fedora avahi Red Hat Enterprise Linux 9 Linux Debian Ubuntu Azure Linux Alpine Wolfi

Nov 2, 2023
Medium 6.2

CVE-2023-38472

Reachable assertion in avahi_rdata_parse

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.

Red Hat Fedora avahi Red Hat Enterprise Linux 9 Linux Debian Ubuntu Azure Linux Alpine Wolfi

Nov 2, 2023
Medium 6.2

CVE-2023-38473

Reachable assertion in avahi_alternative_host_name

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.

Red Hat Fedora avahi Red Hat Enterprise Linux 9 Linux Debian Ubuntu Azure Linux Alpine Wolfi

Nov 2, 2023

References

report
https://access.redhat.com/security/cve/CVE-2023-38469
report
https://access.redhat.com/security/cve/CVE-2023-38470
report
https://access.redhat.com/security/cve/CVE-2023-38471
report
https://access.redhat.com/security/cve/CVE-2023-38472
report
https://access.redhat.com/security/cve/CVE-2023-38473
report
https://bugzilla.redhat.com/2191687
report
https://bugzilla.redhat.com/2191690
report
https://bugzilla.redhat.com/2191691
report
https://bugzilla.redhat.com/2191692
report
https://bugzilla.redhat.com/2191694
advisory
https://errata.almalinux.org/9/ALSA-2024-2433.html