[BLFS Trac] #23150: Fix numerous CVEs in Avahi

#23150: Fix numerous CVEs in Avahi
-----------------------------+-----------------------
 Reporter:  Douglas R. Reno  |      Owner:  blfs-book
     Type:  enhancement      |     Status:  new
 Priority:  elevated         |  Milestone:  13.1
Component:  BOOK             |    Version:  git
 Severity:  normal           |   Keywords:
-----------------------------+-----------------------
 While reviewing my email this morning, I noticed that I got another email
 from oss-security regarding a security vulnerability in Avahi.

 At that point I decided to take a look at
 https://github.com/avahi/avahi/security and see what we are missing.
 Currently we only have a fix for CVE-2021-3468. There is one vulnerability
 there on the second page which is unpatched and has no CVE but it's impact
 is extremely minor so I don't think it's worth waiting on at the moment.

 These vulnerabilities have been fixed in a release candidate version of
 Avahi, but it's probably best to stay with the released version from 2020
 for now. There is an additional CVE which still has a PR going through
 review that could allow for all system file descriptors to be drained via
 an extremely easy local DoS, but it is having both CI problems and issues
 with breaking Avahi on other platforms. For anyone interested, that is
 https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q

 We will need to fix the following vulnerabilities:

 - https://github.com/avahi/avahi/security/advisories/GHSA-v99h-rhv2-7mpq
 ... CVE-2024-2699 and also CVE-2026-24401. Uncontrolled recursion in
 lookup_handle_cname. This is a denial of service impact (segfault), but is
 fixed by
 https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524.
 Rated as Medium

 - https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg
 ... CVE-2025-68471. Reachable assertion in lookup_start. This is another
 denial of service impact (application crash), but is fixed by
 https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1.
 Rated as Medium

 - https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g
 ... CVE-2024-52615. Avahi Wide-Area DNS Uses Constant Source Port. As
 mentioned in the advisory, in some configurations this can open up the
 door to DNS spoofing. Fixed by
 https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942.
 Rated as Medium.

 - https://github.com/avahi/avahi/security/advisories/GHSA-r9j3-vjjh-p8vm
 ... CVE-2024-52616.  Avahi Wide-Area DNS Predictable Transaction IDs. As
 mentioned in the advisory, it allows for attackers to inject DNS records
 in some configurations. Fixed by
 https://github.com/avahi/avahi/pull/659.patch

 - https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52
 ... CVE-2025-68468.  Reachable assertion in lookup_multicast_callback.
 This causes Avahi to crash. Fixed by
 https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a

 - https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc
 ... CVE-2025-68276. Reachable assertion in avahi_wide_area_scan_cache.
 This looks to be another crash caused by calling functions related to wide
 area support when wide area support is disabled. Fixed by https://patch-
 diff.githubusercontent.com/raw/avahi/avahi/pull/806.patch

 - https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc
 ... CVE-2026-34933. Reachable assertion in transport_flags_from_domain.
 Any unprivileged user can crash Avahi this way by simply sending a D-Bus
 call with conflicting publish flags. Fixed by https://patch-
 diff.githubusercontent.com/raw/avahi/avahi/pull/891.patch

 Note that the above issue was discovered and resolved by the head of the
 Vulnerability Operations Center for a cybersecurity company in France.

 - https://github.com/advisories/GHSA-5qm6-j92f-79jp ... CVE-2023-38473.
 Reachable assertion in avahi_alternative_host_name. Fixed by
 https://github.com/avahi/avahi/pull/486 and rated as Medium.

 - https://github.com/advisories/GHSA-4g3h-v9fp-pgm4 ... CVE-2023-38472.
 Reachable assertion in the avahi_rdata_parse() function. Fixed by
 https://github.com/avahi/avahi/pull/490 and rated as Medium.

 - https://github.com/advisories/GHSA-h3x3-j454-4phv ... CVE-2023-38471.
 Reachable assertion in the dbus_set_host_name function. Fixed by
 https://github.com/avahi/avahi/pull/494 and
 https://github.com/avahi/avahi/pull/499 and rated as Medium.

 - https://github.com/advisories/GHSA-mg8v-g9mc-p4f8 ... CVE-2023-38470.
 Reachable assertion in avahi_escape_label. Fixed by
 https://github.com/avahi/avahi/pull/457 and rated as Medium.

 - https://github.com/advisories/GHSA-cg96-q9gq-2pr7 ... CVE-2023-38469.
 Reachable assertion in avahi_dns_packet_append_record. Fixed by
 https://github.com/avahi/avahi/pull/500 and rated as Medium.

 - https://github.com/advisories/GHSA-55h6-xcvg-4r99 ... CVE-2023-1981.
 avahi-daemon can be crashed via DBus. Fixed by
 https://github.com/avahi/avahi/pull/407 and rated as Medium.

 - https://github.com/advisories/GHSA-mw7q-3wxj-rqfx ... CVE-2021-3502 and
 CVE-2021-36217. Reachable assertion in avahi_s_host_name_resolver_start
 when resolving bad hostnames causes the server to crash. Fixed by
 https://github.com/avahi/avahi/pull/324 and rated as Medium.

 As usual with Avahi, things are quite a mess upstream. They have been
 trying to get a new release out (0.9) and it is now well over a year
 overdue. https://github.com/avahi/avahi/issues/503

 If you check the issue linked above, please ignore CVE-2021-26720. It is
 specific to how Debian is packaging it.

 We should resolve these however so we're on the same page as other
 distributions and because this package has been unmaintained for so long.
 The denial of service issues above can be exploited pretty easily by users
 for the most part, and there are also DNS spoofing issues for some
 configurations.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23150>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page