Reachable Assertion in Avahi - CVE-2023-38471

Vulnerability identifier: #VU79308

CSH Severity: Low

CVSS v4 BT: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-38471

CWE-ID: CWE-617

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the dbus_set_host_name() function. A local user can perform a denial of service (DoS) attack.

Avahi
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
openSUSE Leap Micro
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
Basesystem Module
Desktop Applications Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Red Hat OpenShift Serverless
Migration Toolkit for Runtimes
Cryostat
Ansible Automation Platform
Red Hat OpenShift Dev Spaces
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
Red Hat Migration Toolkit for Applications
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Red Hat Single Sign-On
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
avahi-daemon (Ubuntu package)
libavahi-core7 (Ubuntu package)
libavahi-common3 (Ubuntu package)
libavahi-client3 (Ubuntu package)
avahi
avahi (Red Hat package)
avahi-ui-devel
avahi-glib-devel
avahi-gobject
avahi-gobject-devel
avahi-glib
avahi-devel
avahi-libs
avahi-compat-libdns_sd-devel
avahi-ui
avahi-doc
avahi-compat-libdns_sd
avahi-compat-howl-devel
avahi-compat-howl
avahi-ui-gtk3
avahi-autoipd
python3-avahi
libavahi-client3-debuginfo
avahi-debugsource
libavahi-core7-debuginfo
libavahi-client3
avahi-debuginfo
libavahi-core7
libavahi-common3-debuginfo
libavahi-common3
avahi-dnsconfd
avahi-qt5
avahi-tools
avahi-help
avahi-qt5-devel
avahi-tools-debuginfo (Red Hat package)
avahi-glib (Red Hat package)
avahi-tools (Red Hat package)
avahi-autoipd-debuginfo (Red Hat package)
avahi-compat-howl (Red Hat package)
avahi-compat-howl-debuginfo (Red Hat package)
avahi-compat-howl-devel (Red Hat package)
avahi-compat-libdns_sd (Red Hat package)
avahi-compat-libdns_sd-debuginfo (Red Hat package)
avahi-compat-libdns_sd-devel (Red Hat package)
avahi-debuginfo (Red Hat package)
avahi-debugsource (Red Hat package)
avahi-devel (Red Hat package)
avahi-dnsconfd-debuginfo (Red Hat package)
avahi-glib-debuginfo (Red Hat package)
avahi-glib-devel (Red Hat package)
avahi-gobject-debuginfo (Red Hat package)
avahi-libs-debuginfo (Red Hat package)
avahi-ui-debuginfo (Red Hat package)
avahi-ui-gtk3-debuginfo (Red Hat package)
avahi-ui-tools-debuginfo (Red Hat package)
libavahi-ui-gtk3-0-debuginfo
libavahi-glib1
libhowl0-debuginfo
libavahi-gobject0-debuginfo
libavahi-libevent1
libavahi-devel
avahi-glib2-debugsource
avahi-qt5-debugsource
libdns_sd
libavahi-glib1-32bit-debuginfo
avahi-compat-mDNSResponder-devel
typelib-1_0-Avahi-0_6
libavahi-qt5-devel
avahi-utils-gtk
avahi-utils-gtk-debuginfo
libhowl0
libavahi-libevent1-debuginfo
libdns_sd-debuginfo
avahi-utils-debuginfo
libavahi-gobject0
libavahi-qt5-1
libdns_sd-32bit-debuginfo
libavahi-client3-32bit-debuginfo
libavahi-client3-32bit
libavahi-glib1-32bit
avahi-32bit-debuginfo
libavahi-common3-32bit
avahi-lang
libdns_sd-64bit
libdns_sd-64bit-debuginfo
libavahi-common3-64bit
libavahi-client3-64bit-debuginfo
libavahi-common3-64bit-debuginfo
libavahi-glib1-64bit-debuginfo
avahi-64bit-debuginfo
libavahi-client3-64bit
libavahi-glib1-debuginfo
libavahi-glib1-64bit
libavahi-qt5-1-debuginfo
libavahi-gobject-devel
libavahi-glib-devel
python3-avahi-gtk
avahi-autoipd-debuginfo
avahi-utils
libdns_sd-32bit
libavahi-common3-32bit-debuginfo
libavahi-ui-gtk3-0
OpenShift API for Data Protection (OADP)
OpenManage Network Integration (OMNI)
IBM Cloud Pak for Watson AIOps
SmartFabric OS10

Install update from vendor's website.

Red Hat OpenShift Serverless - addressed in versions 1.31.1, 1.32.0
Migration Toolkit for Runtimes - addressed in versions 1.2.4, 1.2.5
Migration Toolkit for Containers - addressed in versions 1.7.15, 1.8.3
Red Hat Single Sign-On - update to 7.6.6
avahi-daemon (Ubuntu package) - addressed in versions Ubuntu Pro, 0.7-4ubuntu7.3, 0.8-5ubuntu5.2, 0.8-6ubuntu1.23.04.2, 0.8-10ubuntu1.1
libavahi-core7 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.7-4ubuntu7.3, 0.8-5ubuntu5.2, 0.8-6ubuntu1.23.04.2, 0.8-10ubuntu1.1
libavahi-common3 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.7-4ubuntu7.3, 0.8-5ubuntu5.2, 0.8-6ubuntu1.23.04.2, 0.8-10ubuntu1.1
libavahi-client3 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.7-4ubuntu7.3, 0.8-5ubuntu5.2, 0.8-6ubuntu1.23.04.2, 0.8-10ubuntu1.1
avahi - addressed in versions 0.6.25-12.19, 0.8-14
avahi (Red Hat package) - addressed in versions 0.7-20.el8_6.3, 0.7-20.el8_8.4, 0.7-21.el8_9.1
avahi-ui-devel - update to 0.7-21.0.1
avahi-glib-devel - update to 0.7-21.0.1
avahi-gobject - update to 0.7-21.0.1
avahi-gobject-devel - update to 0.7-21.0.1
avahi-glib - update to 0.7-21.0.1
avahi-devel - update to 0.7-21.0.1
avahi-libs - update to 0.7-21.0.1
avahi-compat-libdns_sd-devel - update to 0.7-21.0.1
avahi-ui - update to 0.7-21.0.1
avahi-doc - update to 0.7-21.0.1
avahi-compat-libdns_sd - update to 0.7-21.0.1
avahi-compat-howl-devel - update to 0.7-21.0.1
avahi-compat-howl - update to 0.7-21.0.1
avahi-ui-gtk3 - update to 0.7-21.0.1
avahi-autoipd - update to 0.7-21.0.1
python3-avahi - update to 0.7-21.0.1
avahi - update to 0.7-21.0.1
libavahi-client3-debuginfo - addressed in versions 0.7-150100.3.32.1, 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-debugsource - addressed in versions 0.7-150100.3.32.1, 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi - addressed in versions 0.7-150100.3.32.1, 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-core7-debuginfo - addressed in versions 0.7-150100.3.32.1, 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-client3 - addressed in versions 0.7-150100.3.32.1, 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-debuginfo - addressed in versions 0.7-150100.3.32.1, 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-core7 - addressed in versions 0.7-150100.3.32.1, 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-common3-debuginfo - addressed in versions 0.7-150100.3.32.1, 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-common3 - addressed in versions 0.7-150100.3.32.1, 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-glib-devel - update to 0.8-11
avahi-dnsconfd - update to 0.8-11
avahi-qt5 - update to 0.8-11
avahi-ui - update to 0.8-11
avahi-gobject-devel - update to 0.8-11
avahi-autoipd - update to 0.8-11
avahi-tools - update to 0.8-11
avahi-devel - update to 0.8-11
avahi-compat-howl - update to 0.8-11
avahi-libs - update to 0.8-11
avahi-gobject - update to 0.8-11
avahi-debugsource - update to 0.8-11
avahi-compat-howl-devel - update to 0.8-11
avahi-debuginfo - update to 0.8-11
avahi-ui-devel - update to 0.8-11
avahi-help - update to 0.8-11
avahi-glib - update to 0.8-11
avahi - update to 0.8-11
avahi-compat-libdns_sd-devel - update to 0.8-11
avahi-compat-libdns_sd - update to 0.8-11
avahi-qt5-devel - update to 0.8-11
avahi-ui-gtk3 - update to 0.8-11
avahi-tools-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-glib (Red Hat package) - update to 0.8-20.el9
avahi-tools (Red Hat package) - update to 0.8-20.el9
avahi-autoipd-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-compat-howl (Red Hat package) - update to 0.8-20.el9
avahi-compat-howl-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-compat-howl-devel (Red Hat package) - update to 0.8-20.el9
avahi-compat-libdns_sd (Red Hat package) - update to 0.8-20.el9
avahi-compat-libdns_sd-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-compat-libdns_sd-devel (Red Hat package) - update to 0.8-20.el9
avahi-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-debugsource (Red Hat package) - update to 0.8-20.el9
avahi-devel (Red Hat package) - update to 0.8-20.el9
avahi-dnsconfd-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-glib-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-glib-devel (Red Hat package) - update to 0.8-20.el9
avahi-gobject-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-libs-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-ui-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-ui-gtk3-debuginfo (Red Hat package) - update to 0.8-20.el9
avahi-ui-tools-debuginfo (Red Hat package) - update to 0.8-20.el9
libavahi-ui-gtk3-0-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-glib1 - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
python3-avahi - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libhowl0-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-compat-howl-devel - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-gobject0-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-libevent1 - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-devel - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-glib2-debugsource - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-qt5-debugsource - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-autoipd - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libdns_sd - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-glib1-32bit-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-compat-mDNSResponder-devel - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
typelib-1_0-Avahi-0_6 - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-qt5-devel - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-utils-gtk - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-utils-gtk-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libhowl0 - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-libevent1-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libdns_sd-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-utils-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-gobject0 - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-qt5-1 - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libdns_sd-32bit-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-client3-32bit-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-client3-32bit - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-glib1-32bit - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-32bit-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-common3-32bit - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-lang - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libdns_sd-64bit - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libdns_sd-64bit-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-common3-64bit - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-client3-64bit-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-common3-64bit-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-glib1-64bit-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-64bit-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-client3-64bit - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-glib1-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-glib1-64bit - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-qt5-1-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-gobject-devel - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-glib-devel - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
python3-avahi-gtk - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-autoipd-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
avahi-utils - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libdns_sd-32bit - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-common3-32bit-debuginfo - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
libavahi-ui-gtk3-0 - addressed in versions 0.8-150400.7.16.1, 0.8-150600.15.3.1
OpenShift API for Data Protection (OADP) - update to 1.3.2
Ansible Automation Platform - update to 2.4
OpenManage Network Integration (OMNI) - update to 3.7
Red Hat OpenShift Dev Spaces - update to 3.16.0
IBM Cloud Pak for Watson AIOps - update to 4.4.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.5
Red Hat OpenShift Container Platform - addressed in versions 4.16.15, 4.17.0
App Connect Enterprise Certified Container - addressed in versions 5.0.9, 9.1.0
Red Hat Migration Toolkit for Applications - addressed in versions 6.2.3, 7.0.3
SmartFabric OS10 - update to 10.5.6.9

• https://bugzilla.redhat.com/show_bug.cgi?id=2191691
• https://github.com/lathiat/avahi/issues/453

• Multiple vulnerabilities in Avahi
• Amazon Linux AMI update for avahi
• Ubuntu update for avahi
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Red Hat Enterprise Linux 8 update for avahi
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Red Hat Enterprise Linux 8.6 Extended Update Support update for avahi
• Multiple vulnerabilities in Red Hat build of Cryostat 2 on RHEL 8
• Red Hat Enterprise Linux 8.8 Extended Update Support update for avahi
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• openEuler update for avahi
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• SUSE update for avahi
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• SUSE update for avahi
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.8
• Red Hat Enterprise Linux 9 update for avahi
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 6.2
• SUSE update for avahi
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Dell OpenManage Network Integration (OMNI)
• Amazon Linux AMI update for avahi
• Anolis OS update for avahi
• Dell Networking OS10 update for third-party components
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0