linux/poky.git/meta/recipes-connectivity/avahi, branch scarthgap

avahi: patch CVE-2026-24401

2026-02-27T17:45:06+00:00

Details https://nvd.nist.gov/vuln/detail/CVE-2026-24401 (From OE-Core rev: 030a3fff4b05b785f6ed1a97310b8386628adbf9) Signed-off-by: Ankur Tyagi Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 183d0ee54f1c194e245a7bbf243c19b3c2acf4f5) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

avahi: patch CVE-2025-68471

2026-02-27T17:45:06+00:00

(From OE-Core rev: bfd12b872d922116c1a793cd9debb5ee773bfeaf) Signed-off-by: Amaury Couderc Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 5ec4156330c765bc52dbce28dbba6def9868d30f) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

avahi: patch CVE-2025-68468

2026-02-27T17:45:06+00:00

(From OE-Core rev: 1eebd6d5bd5d930aa8ec68f73789ff0bd742441c) Signed-off-by: Amaury Couderc Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 9f2ed8adc37a42b561b3c4853cf8106fba39889e) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

avahi: patch CVE-2025-68276

2026-02-27T17:45:06+00:00

Backport the patch[1] from the PR[2] mentioned in the nvd[3]. [1] https://github.com/avahi/avahi/commit/2d48e42d44a183f26a4d12d1f5d41abb9b7c6355 [2] https://github.com/avahi/avahi/pull/806 [3] https://nvd.nist.gov/vuln/detail/CVE-2025-68276 Dropped CI changes from the original PR during backport. (From OE-Core rev: 4da15f7fad8df7ba5fae29bc72156b189e993d58) Signed-off-by: Ankur Tyagi Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

avahi: fix CVE-2024-52615

2025-08-20T14:37:19+00:00

CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (From OE-Core rev: ec22ec26b3f40ed5e0d84d60c29d8c315cf72e23) Signed-off-by: Zhang Peng Signed-off-by: Steve Sakoman

avahi: fix CVE-2024-52616

2025-01-24T15:59:38+00:00

CVE-2024-52616: A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52616] [https://github.com/avahi/avahi/security/advisories/GHSA-r9j3-vjjh-p8vm] Upstream patches: [https://github.com/avahi/avahi/commit/f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7] (From OE-Core rev: 28de3f131b17dc4165df927060ee51f0de3ada90) Signed-off-by: Zhang Peng Signed-off-by: Steve Sakoman

avahi: backport CVE-2023-1981 & CVE's follow-up patches

2023-12-21T10:38:30+00:00

import patches from ubuntu to fix CVE-2023-1981 CVE-2023-38469-2 CVE-2023-38470-2 CVE-2023-38471-2 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f & https://github.com/lathiat/avahi/commit/c6cab87df290448a63323c8ca759baa516166237 & https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c & https://github.com/lathiat/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460] Ref: https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/nanbield-nut&id=a9203c46cd64c3ec5e5b00e381bbac85733f85df (From OE-Core rev: 2b0d8a63a212897b33e85cc3694cd9a3d6e09ca8) Signed-off-by: Vijay Anusuri Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

avahi: update URL for new project location

2023-12-06T22:55:49+00:00

Avahi has moved to a new parent organisation on GitHub, so update the URLs to match. (From OE-Core rev: 02caef1567186f250e64ae3ef84fcff33d7323e4) Signed-off-by: Ross Burton Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

avahi: fix CVE-2023-38473

2023-11-20T15:30:52+00:00

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. (From OE-Core rev: fbe506e7af1ce47f6d04c122cb77573e0527ab91) Signed-off-by: Meenali Gupta Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

avahi: fix CVE-2023-38472

2023-11-20T15:30:52+00:00

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. (From OE-Core rev: 988d115ca18db1872d7a4dab39040029e5c61d6b) Signed-off-by: Meenali Gupta Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie