|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2023-38472: avahi: Reachable assertion in avahi_rdata_parse | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | SMASH SMASH <smash_bz> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | IN_PROGRESS --- | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | alynx.zhou, camila.matos, gianluca.gabrielli, gnome-bugs, mgorse, praveenkumar.handigol, stoyan.manolov |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/372782/ | ||
| Whiteboard: | CVSSv3.1:SUSE:CVE-2023-38472:6.2:(AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
SMASH SMASH
2023-11-03 08:58:43 UTC
Affected packages: - openSUSE:Factory/avahi - SUSE:SLE-15-SP1:Update/avahi - SUSE:SLE-12-SP2:Update/avahi - SUSE:ALP:Source:Standard:1.0/avahi - SUSE:SLE-15-SP4:Update/avahi - SUSE:SLE-11-SP3:Update/avahi - SUSE:SLE-15:Update/avahi Upstream patch: https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40 Hi, I'll try to handle this. It looks like we don't have `fuzz` support in current version of avahi, so for PR <https://github.com/lathiat/avahi/pull/492>, I think backport <https://github.com/lathiat/avahi/pull/492/commits/160e8fb6ca1b33387f30f7a6aa9159015ffda9d0> is enough. https://build.opensuse.org/request/show/1129882 For GNOME:Factory. https://build.opensuse.org/request/show/1129885 For GNOME:STABLE:41 https://build.suse.de/request/show/314049 For Devel:Desktop:SLE12:SP2 https://build.suse.de/request/show/314050 For Devel:Desktop:SLE-15-SP1 https://build.suse.de/request/show/314141 For Devel:Desktop:SLE12:SP2 https://build.suse.de/request/show/314142 For Devel:Desktop:SLE-15-SP1 https://build.opensuse.org/request/show/1129990 For openSUSE:Factory https://build.suse.de/request/show/314143 For SUSE:ALP:Source:Standard:1.0/avahi https://build.suse.de/request/show/314144 For SLE-15-SP4 SUSE-SU-2023:4901-1: An update that solves one vulnerability can now be installed. Category: security (moderate) Bug References: 1216853 CVE References: CVE-2023-38472 Sources used: openSUSE Leap 15.4 (src): avahi-0.8-150400.7.13.1, avahi-qt5-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 openSUSE Leap Micro 5.3 (src): avahi-0.8-150400.7.13.1 openSUSE Leap Micro 5.4 (src): avahi-0.8-150400.7.13.1 openSUSE Leap 15.5 (src): avahi-0.8-150400.7.13.1, avahi-qt5-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): avahi-0.8-150400.7.13.1 SUSE Linux Enterprise Micro 5.3 (src): avahi-0.8-150400.7.13.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): avahi-0.8-150400.7.13.1 SUSE Linux Enterprise Micro 5.4 (src): avahi-0.8-150400.7.13.1 SUSE Linux Enterprise Micro 5.5 (src): avahi-0.8-150400.7.13.1 Basesystem Module 15-SP4 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 Basesystem Module 15-SP5 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 Desktop Applications Module 15-SP4 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 Desktop Applications Module 15-SP5 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 SUSE Package Hub 15 15-SP4 (src): avahi-0.8-150400.7.13.1 SUSE Package Hub 15 15-SP5 (src): avahi-0.8-150400.7.13.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. I am in the process of building Avahi CVE fixes by checking out the sources from dev branches. I will raise SR for code review shortly. SUSE-SU-2024:1500-1: An update that solves two vulnerabilities can now be installed. Category: security (moderate) Bug References: 1215947, 1216853 CVE References: CVE-2023-38470, CVE-2023-38472 Maintenance Incident: [SUSE:Maintenance:33589](https://smelt.suse.de/incident/33589/) Sources used: SUSE Linux Enterprise Workstation Extension 12 12-SP5 (src): avahi-glib2-0.6.32-32.27.1 SUSE Linux Enterprise Software Development Kit 12 SP5 (src): avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1 SUSE Linux Enterprise Server 12 SP5 (src): avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2024:1569-1: An update that solves one vulnerability can now be installed. Category: security (moderate) Bug References: 1216853 CVE References: CVE-2023-38472 Maintenance Incident: [SUSE:Maintenance:33718](https://smelt.suse.de/incident/33718/) Sources used: SUSE Linux Enterprise Micro 5.2 (src): avahi-0.7-150100.3.35.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): avahi-0.7-150100.3.35.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. |