linux/poky.git/meta/recipes-connectivity/avahi, branch yocto-4.0.29

avahi: fix CVE-2024-52615

2025-08-08T13:30:55+00:00

CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (From OE-Core rev: 7bd9fee6d654326ea921b51113de99f793e11545) Signed-off-by: Zhang Peng Signed-off-by: Steve Sakoman

avahi: fix CVE-2024-52616

2025-01-24T15:49:28+00:00

CVE-2024-52616: A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52616] [https://github.com/avahi/avahi/security/advisories/GHSA-r9j3-vjjh-p8vm] Upstream patches: [https://github.com/avahi/avahi/commit/f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7] (From OE-Core rev: 7708d0c346b23ab3e687e2a2ca464d77d55cebd7) Signed-off-by: Zhang Peng Signed-off-by: Steve Sakoman

avahi: backport CVE-2023-1981 & CVE's follow-up patches

2023-12-15T14:00:33+00:00

import patches from ubuntu to fix CVE-2023-1981 CVE-2023-38469-2 CVE-2023-38470-2 CVE-2023-38471-2 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f & https://github.com/lathiat/avahi/commit/c6cab87df290448a63323c8ca759baa516166237 & https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c & https://github.com/lathiat/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460] Ref: https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/nanbield-nut&id=a9203c46cd64c3ec5e5b00e381bbac85733f85df (From OE-Core rev: 32c0a3dc4d65065639260e77783dc427d4b1cfe3) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

avahi: fix CVE-2023-38473

2023-11-28T15:00:32+00:00

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. (From OE-Core rev: 3a9b67f222d6e004a8b56eedca6ff869e9aba710) Signed-off-by: Meenali Gupta Signed-off-by: Steve Sakoman

avahi: fix CVE-2023-38472

2023-11-28T15:00:32+00:00

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. (From OE-Core rev: 1b699ac1e8519cd488ee033919b9205283b7b465) Signed-off-by: Meenali Gupta Signed-off-by: Steve Sakoman

avahi: fix CVE-2023-38469

2023-11-28T15:00:32+00:00

A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record. (From OE-Core rev: 8bd1980fd4175be3dd68987f8c5653409b76f544) Signed-off-by: Meenali Gupta Signed-off-by: Steve Sakoman

avahi: fix CVE-2023-38470

2023-11-28T15:00:32+00:00

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function. (From OE-Core rev: bc211ae0e597d40f938f9a25bfc0fcbb228d90b6) Signed-off-by: Meenali Gupta Signed-off-by: Steve Sakoman

avahi: fix CVE-2023-38471

2023-11-28T15:00:32+00:00

A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. (From OE-Core rev: f4286c3a3070fd50e334a48f1b7c068d34747115) Signed-off-by: Meenali Gupta Signed-off-by: Steve Sakoman

avahi: fix D-Bus introspection

2023-05-30T14:11:15+00:00

Install and package the D-Bus introspection files. (From OE-Core rev: 45714f9ea8bde1c8047d493667b1a1d808ea7949) Signed-off-by: Eero Aaltonen Signed-off-by: Alexandre Belloni (cherry picked from commit b8183ad25af3bcf23f04dd649b6ef665569fac8c) Signed-off-by: Eero Aaltonen Signed-off-by: Steve Sakoman

meta, meta-selftest: Replace more non-SPDX license identifiers

2022-03-01T23:44:59+00:00

In commit ceda3238 (meta/meta-selftest/meta-skeleton: Update LICENSE variable to use SPDX license identifiers) all LICENSE variables were updated to only use SPDX license identifiers. This does the same for comments and other variables where it is appropriate to use the official SPDX license identifiers. There are still references to, e.g., "GPLv3", but they are then typically in descriptive text where they refer to the license in a generic sense. (From OE-Core rev: 165759dced7fbe73b1db2ede67047896071dc6d0) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie