Bug 33829 - avahi new security issues CVE-2024-5261[56]
Summary: avahi new security issues CVE-2024-5261[56]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-12-04 16:04 CET by Nicolas Salguero
Modified: 2025-01-12 07:41 CET (History)
4 users (show)

See Also:
Source RPM: avahi-0.8-10.1.mga9.src.rpm
CVE: CVE-2024-52615, CVE-2024-52616
Status comment:


Attachments

Description Nicolas Salguero 2024-12-04 16:04:32 CET
openSUSE has issued an advisory on December 3:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/G3ABDXZMFN73MQ62ZJOBQIVUE3HAEKVL/

Fix: https://github.com/avahi/avahi/pull/577 (avahi-daemon.conf: turn off wide-area)
Nicolas Salguero 2024-12-04 16:05:41 CET

Source RPM: (none) => avahi-0.8-13.mga10.src.rpm, avahi-0.8-10.1.mga9.src.rpm
Status comment: (none) => Patch available from openSUSE and upstream
CVE: (none) => CVE-2024-52615, CVE-2024-52616
Whiteboard: (none) => MGA9TOO

Comment 1 Morgan Leijström 2024-12-04 17:25:43 CET
This package have no registered maintainer.
Assigning last packager.
If you can not take it, please assign to all.

Assignee: bugsquad => pterjan
CC: (none) => fri

Comment 2 Nicolas Salguero 2025-01-10 09:47:08 CET
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

Avahi wide-area dns uses constant source port. (CVE-2024-52615)

Avahi wide-area dns predictable transaction ids. (CVE-2024-52616)

References:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/G3ABDXZMFN73MQ62ZJOBQIVUE3HAEKVL/
========================

Updated packages in core/updates_testing:
========================
avahi-0.8-10.2.mga9
avahi-dnsconfd-0.8-10.2.mga9
avahi-sharp-0.8-10.2.mga9
avahi-sharp-doc-0.8-10.2.mga9
avahi-x11-0.8-10.2.mga9
lib(64)avahi-client3-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-client-devel-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-common3-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-common-devel-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-compat-howl0-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-compat-howl-devel-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-compat-libdns_sd1-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-compat-libdns_sd-devel-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-core7-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-core-devel-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-gir0.6-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-glib1-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-glib-devel-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-gobject0-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-gobject-devel-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-libevent1-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-libevent-devel-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-qt5_1-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-qt5-devel-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-ui-gtk3_0-0.8-10.2.mga9.x86_64.rpm
lib(64)avahi-ui-gtk3-devel-0.8-10.2.mga9.x86_64.rpm
lib(64)avahicore-gir0.6-0.8-10.2.mga9.x86_64.rpm

from SRPM:
avahi-0.8-10.2.mga9.src.rpm

Source RPM: avahi-0.8-13.mga10.src.rpm, avahi-0.8-10.1.mga9.src.rpm => avahi-0.8-10.1.mga9.src.rpm
Assignee: pterjan => qa-bugs
Status comment: Patch available from openSUSE and upstream => (none)
Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)
Status: NEW => ASSIGNED

Comment 3 Herman Viaene 2025-01-10 15:53:20 CET
MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Ref bug 32363 Comment 6 for testing.
Used the commands 
avahi-discover-standalone
and
avahi-browse --all -t
Both providing sensible output.
OK for me.

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

katnatek 2025-01-10 19:44:00 CET

Keywords: (none) => advisory

Comment 4 Thomas Andrews 2025-01-11 17:15:18 CET
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 5 Mageia Robot 2025-01-12 07:41:49 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0007.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.