Bugzilla – Bug 1216853
VUL-0: CVE-2023-38472: avahi: Reachable assertion in avahi_rdata_parse
Last modified: 2024-05-09 14:35:52 UTC
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38472 https://github.com/lathiat/avahi/issues/452 https://github.com/lathiat/avahi/pull/490
Affected packages: - openSUSE:Factory/avahi - SUSE:SLE-15-SP1:Update/avahi - SUSE:SLE-12-SP2:Update/avahi - SUSE:ALP:Source:Standard:1.0/avahi - SUSE:SLE-15-SP4:Update/avahi - SUSE:SLE-11-SP3:Update/avahi - SUSE:SLE-15:Update/avahi Upstream patch: https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40
Hi, I'll try to handle this.
It looks like we don't have `fuzz` support in current version of avahi, so for PR <https://github.com/lathiat/avahi/pull/492>, I think backport <https://github.com/lathiat/avahi/pull/492/commits/160e8fb6ca1b33387f30f7a6aa9159015ffda9d0> is enough.
https://build.opensuse.org/request/show/1129882 For GNOME:Factory. https://build.opensuse.org/request/show/1129885 For GNOME:STABLE:41
https://build.suse.de/request/show/314049 For Devel:Desktop:SLE12:SP2 https://build.suse.de/request/show/314050 For Devel:Desktop:SLE-15-SP1
https://build.suse.de/request/show/314141 For Devel:Desktop:SLE12:SP2 https://build.suse.de/request/show/314142 For Devel:Desktop:SLE-15-SP1
https://build.opensuse.org/request/show/1129990 For openSUSE:Factory https://build.suse.de/request/show/314143 For SUSE:ALP:Source:Standard:1.0/avahi https://build.suse.de/request/show/314144 For SLE-15-SP4
SUSE-SU-2023:4901-1: An update that solves one vulnerability can now be installed. Category: security (moderate) Bug References: 1216853 CVE References: CVE-2023-38472 Sources used: openSUSE Leap 15.4 (src): avahi-0.8-150400.7.13.1, avahi-qt5-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 openSUSE Leap Micro 5.3 (src): avahi-0.8-150400.7.13.1 openSUSE Leap Micro 5.4 (src): avahi-0.8-150400.7.13.1 openSUSE Leap 15.5 (src): avahi-0.8-150400.7.13.1, avahi-qt5-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): avahi-0.8-150400.7.13.1 SUSE Linux Enterprise Micro 5.3 (src): avahi-0.8-150400.7.13.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): avahi-0.8-150400.7.13.1 SUSE Linux Enterprise Micro 5.4 (src): avahi-0.8-150400.7.13.1 SUSE Linux Enterprise Micro 5.5 (src): avahi-0.8-150400.7.13.1 Basesystem Module 15-SP4 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 Basesystem Module 15-SP5 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 Desktop Applications Module 15-SP4 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 Desktop Applications Module 15-SP5 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1 SUSE Package Hub 15 15-SP4 (src): avahi-0.8-150400.7.13.1 SUSE Package Hub 15 15-SP5 (src): avahi-0.8-150400.7.13.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
I am in the process of building Avahi CVE fixes by checking out the sources from dev branches. I will raise SR for code review shortly.
SUSE-SU-2024:1500-1: An update that solves two vulnerabilities can now be installed. Category: security (moderate) Bug References: 1215947, 1216853 CVE References: CVE-2023-38470, CVE-2023-38472 Maintenance Incident: [SUSE:Maintenance:33589](https://smelt.suse.de/incident/33589/) Sources used: SUSE Linux Enterprise Workstation Extension 12 12-SP5 (src): avahi-glib2-0.6.32-32.27.1 SUSE Linux Enterprise Software Development Kit 12 SP5 (src): avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1 SUSE Linux Enterprise Server 12 SP5 (src): avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1569-1: An update that solves one vulnerability can now be installed. Category: security (moderate) Bug References: 1216853 CVE References: CVE-2023-38472 Maintenance Incident: [SUSE:Maintenance:33718](https://smelt.suse.de/incident/33718/) Sources used: SUSE Linux Enterprise Micro 5.2 (src): avahi-0.7-150100.3.35.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): avahi-0.7-150100.3.35.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.