Security update for avahi SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:1845-1 Final 1 1 2021-07-11T05:49:43Z current 2021-07-11T05:49:43Z 2021-07-11T05:49:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for avahi This update for avahi fixes the following issues: - CVE-2021-3468: avoid infinite loop by handling HUP event in client_work (bsc#1184521). - CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827) - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Add sudo to requires: used to drop privileges. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2021-1845 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YAJ7F7M4LLALLHLSQR7PD7HCTVHGAFMX/ E-Mail link for openSUSE-SU-2021:1845-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1180827 SUSE Bug 1180827 https://bugzilla.suse.com/1184521 SUSE Bug 1184521 https://www.suse.com/security/cve/CVE-2021-26720/ SUSE CVE CVE-2021-26720 page https://www.suse.com/security/cve/CVE-2021-3468/ SUSE CVE CVE-2021-3468 page openSUSE Leap 15.3 python-avahi-0.6.32-5.13.1 python-avahi-gtk-0.6.32-5.13.1 python-avahi-0.6.32-5.13.1 as a component of openSUSE Leap 15.3 python-avahi-gtk-0.6.32-5.13.1 as a component of openSUSE Leap 15.3 avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product. CVE-2021-26720 openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1 openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YAJ7F7M4LLALLHLSQR7PD7HCTVHGAFMX/ https://www.suse.com/security/cve/CVE-2021-26720.html CVE-2021-26720 https://bugzilla.suse.com/1180827 SUSE Bug 1180827 https://bugzilla.suse.com/1180865 SUSE Bug 1180865 https://bugzilla.suse.com/1181852 SUSE Bug 1181852 https://bugzilla.suse.com/1186412 SUSE Bug 1186412 https://bugzilla.suse.com/1205048 SUSE Bug 1205048 A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered. CVE-2021-3468 openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1 openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YAJ7F7M4LLALLHLSQR7PD7HCTVHGAFMX/ https://www.suse.com/security/cve/CVE-2021-3468.html CVE-2021-3468 https://bugzilla.suse.com/1184521 SUSE Bug 1184521