Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.2
Avahi packages could let attackers gain network access
published 2 years ago
Summary
The Avahi networking tools on Red Hat systems contain a weakness that could be used to bypass normal access controls and move within the internal network. This may let an attacker discover or interact with other devices without proper permission. Apply the latest Red Hat updates for all Avahi packages as soon as possible.
What to do
- Update redhat avahi-autoipd-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi-compat-howl-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi-compat-libdns_sd-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi-debugsource to version 0:0.7-21.el8_9.1.
- Update redhat avahi-dnsconfd-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi-glib-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi-gobject-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi-libs-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi-tools to version 0:0.7-21.el8_9.1.
- Update redhat avahi-tools-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi-ui-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi-ui-gtk3 to version 0:0.7-21.el8_9.1.
- Update redhat avahi-ui-gtk3-debuginfo to version 0:0.7-21.el8_9.1.
- Update redhat avahi to version 0:0.7-21.el8_9.1.
- Update redhat avahi-autoipd to version 0:0.7-21.el8_9.1.
- Update redhat avahi-glib to version 0:0.7-21.el8_9.1.
- Update redhat avahi-gobject to version 0:0.7-21.el8_9.1.
- Update redhat avahi-libs to version 0:0.7-21.el8_9.1.
- Update redhat python3-avahi to version 0:0.7-21.el8_9.1.
- Update redhat avahi-compat-howl to version 0:0.7-21.el8_9.1.
- Update redhat avahi-compat-howl-devel to version 0:0.7-21.el8_9.1.
- Update redhat avahi-compat-libdns_sd to version 0:0.7-21.el8_9.1.
- Update redhat avahi-compat-libdns_sd-devel to version 0:0.7-21.el8_9.1.
- Update redhat avahi-devel to version 0:0.7-21.el8_9.1.
- Update redhat avahi-glib-devel to version 0:0.7-21.el8_9.1.
- Update redhat avahi-gobject-devel to version 0:0.7-21.el8_9.1.
- Update redhat avahi-ui to version 0:0.7-21.el8_9.1.
- Update redhat avahi-ui-devel to version 0:0.7-21.el8_9.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-autoipd-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-compat-howl-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-compat-libdns_sd-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-debugsource |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-dnsconfd-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-glib-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-gobject-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-libs-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-tools |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-tools-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-ui-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-ui-gtk3 |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::appstream | redhat | avahi-ui-gtk3-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-autoipd |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-autoipd-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-compat-howl-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-compat-libdns_sd-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-debugsource |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-dnsconfd-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-glib |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-glib-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-gobject |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-gobject-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-libs |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-libs-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-tools-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-ui-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | avahi-ui-gtk3-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::baseos | redhat | python3-avahi |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-autoipd-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-compat-howl |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-compat-howl-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-compat-howl-devel |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-compat-libdns_sd |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-compat-libdns_sd-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-compat-libdns_sd-devel |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-debugsource |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-devel |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-dnsconfd-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-glib-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-glib-devel |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-gobject-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-gobject-devel |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-libs-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-tools-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-ui |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
Showing 50 of 53. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-ui-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-ui-devel |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
| Red Hat:enterprise_linux:8::crb | redhat | avahi-ui-gtk3-debuginfo |
< 0:0.7-21.el8_9.1 Fix: upgrade to 0:0.7-21.el8_9.1
|
Original advisory text
Red Hat Security Advisory: avahi security update
References
- https://access.redhat.com/errata/RHSA-2023:7836 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1939614 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2191687 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2191690 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2191691 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2191692 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2191694 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7836.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2021-3468 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-3468 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-3468 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-38469 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-38469 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-38469 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-38470 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-38470 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-38470 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-38471 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-38471 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-38471 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-38472 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-38472 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-38472 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-38473 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-38473 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-38473 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published16 Sep 2024
Updated14 Sep 2026
First seen14 Sep 2026
Sources
RHSA-2023:7836 · OSV
Track software like this
Free during beta