{"document":{"aggregate_severity":{"namespace":"https://www.suse.com/support/security/rating/","text":"important"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright 2024 SUSE LLC. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"Security update for avahi","title":"Title of the patch"},{"category":"description","text":"This update for avahi fixes the following issues:\n\n- CVE-2021-3468: avoid infinite loop by handling  HUP event in client_work (bsc#1184521).\n- CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)\n- Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d.\n- Add sudo to requires: used to drop privileges.\n","title":"Description of the patch"},{"category":"details","text":"openSUSE-SLE-15.3-2021-1845","title":"Patchnames"},{"category":"legal_disclaimer","text":"CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).","title":"Terms of use"}],"publisher":{"category":"vendor","contact_details":"https://www.suse.com/support/security/contact/","name":"SUSE Product Security Team","namespace":"https://www.suse.com/"},"references":[{"category":"external","summary":"SUSE ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"self","summary":"URL of this CSAF notice","url":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_1845-1.json"},{"category":"self","summary":"URL for openSUSE-SU-2021:1845-1","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YAJ7F7M4LLALLHLSQR7PD7HCTVHGAFMX/"},{"category":"self","summary":"E-Mail link for openSUSE-SU-2021:1845-1","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YAJ7F7M4LLALLHLSQR7PD7HCTVHGAFMX/"},{"category":"self","summary":"SUSE Bug 1180827","url":"https://bugzilla.suse.com/1180827"},{"category":"self","summary":"SUSE Bug 1184521","url":"https://bugzilla.suse.com/1184521"},{"category":"self","summary":"SUSE CVE CVE-2021-26720 page","url":"https://www.suse.com/security/cve/CVE-2021-26720/"},{"category":"self","summary":"SUSE CVE CVE-2021-3468 page","url":"https://www.suse.com/security/cve/CVE-2021-3468/"}],"title":"Security update for avahi","tracking":{"current_release_date":"2021-07-11T05:49:43Z","generator":{"date":"2021-07-11T05:49:43Z","engine":{"name":"cve-database.git:bin/generate-csaf.pl","version":"1"}},"id":"openSUSE-SU-2021:1845-1","initial_release_date":"2021-07-11T05:49:43Z","revision_history":[{"date":"2021-07-11T05:49:43Z","number":"1","summary":"Current version"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"python-avahi-0.6.32-5.13.1.aarch64","product":{"name":"python-avahi-0.6.32-5.13.1.aarch64","product_id":"python-avahi-0.6.32-5.13.1.aarch64"}},{"category":"product_version","name":"python-avahi-gtk-0.6.32-5.13.1.aarch64","product":{"name":"python-avahi-gtk-0.6.32-5.13.1.aarch64","product_id":"python-avahi-gtk-0.6.32-5.13.1.aarch64"}}],"category":"architecture","name":"aarch64"},{"branches":[{"category":"product_version","name":"python-avahi-0.6.32-5.13.1.ppc64le","product":{"name":"python-avahi-0.6.32-5.13.1.ppc64le","product_id":"python-avahi-0.6.32-5.13.1.ppc64le"}},{"category":"product_version","name":"python-avahi-gtk-0.6.32-5.13.1.ppc64le","product":{"name":"python-avahi-gtk-0.6.32-5.13.1.ppc64le","product_id":"python-avahi-gtk-0.6.32-5.13.1.ppc64le"}}],"category":"architecture","name":"ppc64le"},{"branches":[{"category":"product_version","name":"python-avahi-0.6.32-5.13.1.s390x","product":{"name":"python-avahi-0.6.32-5.13.1.s390x","product_id":"python-avahi-0.6.32-5.13.1.s390x"}},{"category":"product_version","name":"python-avahi-gtk-0.6.32-5.13.1.s390x","product":{"name":"python-avahi-gtk-0.6.32-5.13.1.s390x","product_id":"python-avahi-gtk-0.6.32-5.13.1.s390x"}}],"category":"architecture","name":"s390x"},{"branches":[{"category":"product_version","name":"python-avahi-0.6.32-5.13.1.x86_64","product":{"name":"python-avahi-0.6.32-5.13.1.x86_64","product_id":"python-avahi-0.6.32-5.13.1.x86_64"}},{"category":"product_version","name":"python-avahi-gtk-0.6.32-5.13.1.x86_64","product":{"name":"python-avahi-gtk-0.6.32-5.13.1.x86_64","product_id":"python-avahi-gtk-0.6.32-5.13.1.x86_64"}}],"category":"architecture","name":"x86_64"},{"branches":[{"category":"product_name","name":"openSUSE Leap 15.3","product":{"name":"openSUSE Leap 15.3","product_id":"openSUSE Leap 15.3","product_identification_helper":{"cpe":"cpe:/o:opensuse:leap:15.3"}}}],"category":"product_family","name":"SUSE Linux Enterprise"}],"category":"vendor","name":"SUSE"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"python-avahi-0.6.32-5.13.1.aarch64 as component of openSUSE Leap 15.3","product_id":"openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.aarch64"},"product_reference":"python-avahi-0.6.32-5.13.1.aarch64","relates_to_product_reference":"openSUSE Leap 15.3"},{"category":"default_component_of","full_product_name":{"name":"python-avahi-0.6.32-5.13.1.ppc64le as component of openSUSE Leap 15.3","product_id":"openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.ppc64le"},"product_reference":"python-avahi-0.6.32-5.13.1.ppc64le","relates_to_product_reference":"openSUSE Leap 15.3"},{"category":"default_component_of","full_product_name":{"name":"python-avahi-0.6.32-5.13.1.s390x as component of openSUSE Leap 15.3","product_id":"openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.s390x"},"product_reference":"python-avahi-0.6.32-5.13.1.s390x","relates_to_product_reference":"openSUSE Leap 15.3"},{"category":"default_component_of","full_product_name":{"name":"python-avahi-0.6.32-5.13.1.x86_64 as component of openSUSE Leap 15.3","product_id":"openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.x86_64"},"product_reference":"python-avahi-0.6.32-5.13.1.x86_64","relates_to_product_reference":"openSUSE Leap 15.3"},{"category":"default_component_of","full_product_name":{"name":"python-avahi-gtk-0.6.32-5.13.1.aarch64 as component of openSUSE Leap 15.3","product_id":"openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.aarch64"},"product_reference":"python-avahi-gtk-0.6.32-5.13.1.aarch64","relates_to_product_reference":"openSUSE Leap 15.3"},{"category":"default_component_of","full_product_name":{"name":"python-avahi-gtk-0.6.32-5.13.1.ppc64le as component of openSUSE Leap 15.3","product_id":"openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.ppc64le"},"product_reference":"python-avahi-gtk-0.6.32-5.13.1.ppc64le","relates_to_product_reference":"openSUSE Leap 15.3"},{"category":"default_component_of","full_product_name":{"name":"python-avahi-gtk-0.6.32-5.13.1.s390x as component of openSUSE Leap 15.3","product_id":"openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.s390x"},"product_reference":"python-avahi-gtk-0.6.32-5.13.1.s390x","relates_to_product_reference":"openSUSE Leap 15.3"},{"category":"default_component_of","full_product_name":{"name":"python-avahi-gtk-0.6.32-5.13.1.x86_64 as component of openSUSE Leap 15.3","product_id":"openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.x86_64"},"product_reference":"python-avahi-gtk-0.6.32-5.13.1.x86_64","relates_to_product_reference":"openSUSE Leap 15.3"}]},"vulnerabilities":[{"cve":"CVE-2021-26720","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2021-26720"}],"notes":[{"category":"general","text":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","title":"CVE description"}],"product_status":{"recommended":["openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.x86_64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2021-26720","url":"https://www.suse.com/security/cve/CVE-2021-26720"},{"category":"external","summary":"SUSE Bug 1180827 for CVE-2021-26720","url":"https://bugzilla.suse.com/1180827"},{"category":"external","summary":"SUSE Bug 1180865 for CVE-2021-26720","url":"https://bugzilla.suse.com/1180865"},{"category":"external","summary":"SUSE Bug 1181852 for CVE-2021-26720","url":"https://bugzilla.suse.com/1181852"},{"category":"external","summary":"SUSE Bug 1186412 for CVE-2021-26720","url":"https://bugzilla.suse.com/1186412"},{"category":"external","summary":"SUSE Bug 1205048 for CVE-2021-26720","url":"https://bugzilla.suse.com/1205048"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.x86_64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.x86_64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.x86_64"]}],"threats":[{"category":"impact","date":"2021-07-11T05:49:43Z","details":"important"}],"title":"CVE-2021-26720"},{"cve":"CVE-2021-3468","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2021-3468"}],"notes":[{"category":"general","text":"A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.","title":"CVE description"}],"product_status":{"recommended":["openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.x86_64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.x86_64"]},"references":[{"category":"external","summary":"CVE-2021-3468","url":"https://www.suse.com/security/cve/CVE-2021-3468"},{"category":"external","summary":"SUSE Bug 1184521 for CVE-2021-3468","url":"https://bugzilla.suse.com/1184521"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.x86_64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.x86_64"]}],"scores":[{"cvss_v3":{"baseScore":6.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-0.6.32-5.13.1.x86_64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.aarch64","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.ppc64le","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.s390x","openSUSE Leap 15.3:python-avahi-gtk-0.6.32-5.13.1.x86_64"]}],"threats":[{"category":"impact","date":"2021-07-11T05:49:43Z","details":"moderate"}],"title":"CVE-2021-3468"}]}