Bugzilla – Bug 1216598
VUL-0: CVE-2023-38469: avahi: CVEs assigned for reachable assertions in avahi
Last modified: 2024-07-12 16:31:04 UTC
Posted by Alan Coopersmith on Oct 06While the CVE database still shows them as reserved, Red Hat's & Debian's trackers show several CVE's being assigned for client requests that can cause the Avahi server to abort with an assertion failure. Only one of them has a fix available so far. ---------------------------------------------------------------------------- CVE-2023-38469: https://github.com/lathiat/avahi/issues/455 Reachable assertion in... References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38469
Affected packages: - SUSE:ALP:Source:Standard:1.0/avahi - SUSE:SLE-12-SP2:Update/avahi - SUSE:SLE-15-SP1:Update/avahi - SUSE:SLE-15-SP4:Update/avahi Upstream patch at https://github.com/lathiat/avahi/commit/61b9874ff91dd20a12483db07df29fe7f35db77f
The source patches have been generated and I am in the process of building Avahi with the development branch source code. I will be submitting it for the review ASAP.
SUSE-SU-2024:1008-1: An update that solves two vulnerabilities can now be installed. Category: security (moderate) Bug References: 1216594, 1216598 CVE References: CVE-2023-38469, CVE-2023-38471 Maintenance Incident: [SUSE:Maintenance:33131](https://smelt.suse.de/incident/33131/) Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): avahi-glib2-0.6.32-32.24.1, avahi-0.6.32-32.24.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): avahi-glib2-0.6.32-32.24.1, avahi-0.6.32-32.24.1 SUSE Linux Enterprise Server 12 SP5 (src): avahi-glib2-0.6.32-32.24.1, avahi-0.6.32-32.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): avahi-glib2-0.6.32-32.24.1, avahi-0.6.32-32.24.1 SUSE Linux Enterprise Workstation Extension 12 12-SP5 (src): avahi-glib2-0.6.32-32.24.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1014-1: An update that solves two vulnerabilities can now be installed. Category: security (moderate) Bug References: 1216594, 1216598 CVE References: CVE-2023-38469, CVE-2023-38471 Maintenance Incident: [SUSE:Maintenance:33129](https://smelt.suse.de/incident/33129/) Sources used: openSUSE Leap 15.4 (src): avahi-qt5-0.8-150400.7.16.1, avahi-0.8-150400.7.16.1, avahi-glib2-0.8-150400.7.16.1 openSUSE Leap Micro 5.3 (src): avahi-0.8-150400.7.16.1 openSUSE Leap Micro 5.4 (src): avahi-0.8-150400.7.16.1 openSUSE Leap 15.5 (src): avahi-qt5-0.8-150400.7.16.1, avahi-0.8-150400.7.16.1, avahi-glib2-0.8-150400.7.16.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): avahi-0.8-150400.7.16.1 SUSE Linux Enterprise Micro 5.3 (src): avahi-0.8-150400.7.16.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): avahi-0.8-150400.7.16.1 SUSE Linux Enterprise Micro 5.4 (src): avahi-0.8-150400.7.16.1 SUSE Linux Enterprise Micro 5.5 (src): avahi-0.8-150400.7.16.1 Basesystem Module 15-SP5 (src): avahi-0.8-150400.7.16.1, avahi-glib2-0.8-150400.7.16.1 Desktop Applications Module 15-SP5 (src): avahi-0.8-150400.7.16.1, avahi-glib2-0.8-150400.7.16.1 SUSE Package Hub 15 15-SP5 (src): avahi-0.8-150400.7.16.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1118-1: An update that solves two vulnerabilities can now be installed. Category: security (moderate) Bug References: 1216594, 1216598 CVE References: CVE-2023-38469, CVE-2023-38471 Maintenance Incident: [SUSE:Maintenance:33130](https://smelt.suse.de/incident/33130/) Sources used: SUSE Linux Enterprise Micro 5.2 (src): avahi-0.7-150100.3.32.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): avahi-0.7-150100.3.32.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:2200-1: An update that solves two vulnerabilities and has one security fix can now be installed. Category: security (moderate) Bug References: 1216594, 1216598, 1226586 CVE References: CVE-2023-38469, CVE-2023-38471 Maintenance Incident: [SUSE:Maintenance:34466](https://smelt.suse.de/incident/34466/) Sources used: openSUSE Leap 15.6 (src): avahi-qt5-0.8-150600.15.3.1, avahi-0.8-150600.15.3.1, avahi-glib2-0.8-150600.15.3.1 Basesystem Module 15-SP6 (src): avahi-0.8-150600.15.3.1, avahi-glib2-0.8-150600.15.3.1 Desktop Applications Module 15-SP6 (src): avahi-0.8-150600.15.3.1, avahi-glib2-0.8-150600.15.3.1 SUSE Package Hub 15 15-SP6 (src): avahi-0.8-150600.15.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1014-2: An update that solves two vulnerabilities can now be installed. Category: security (moderate) Bug References: 1216594, 1216598 CVE References: CVE-2023-38469, CVE-2023-38471 Maintenance Incident: [SUSE:Maintenance:33129](https://smelt.suse.de/incident/33129/) Sources used: SUSE Linux Enterprise Micro 5.5 (src): avahi-0.8-150400.7.16.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.