]> code.ossystems Code Review - openembedded-core.git/commit
avahi: fix CVE-2021-3468
authorSteve Sakoman <steve@sakoman.com>
Wed, 21 Jul 2021 17:33:19 +0000 (07:33 -1000)
committerSteve Sakoman <steve@sakoman.com>
Mon, 26 Jul 2021 14:38:59 +0000 (04:38 -1000)
commit7ca7aeb7c703bfa22c9f128849e11b62f93d81b5
treedd0ae76098ff9e3c6de992fa6e31367b6d5f5816
parent1699293a7011797895c284d6ad664c66badba426
avahi: fix CVE-2021-3468

A flaw was found in avahi in versions 0.6 up to 0.8. The event used
to signal the termination of the client connection on the avahi Unix
socket is not correctly handled in the client_work function,
allowing a local attacker to trigger an infinite loop. The highest
threat from this vulnerability is to the availability of the avahi
service, which becomes unresponsive after this flaw is triggered.

https://nvd.nist.gov/vuln/detail/CVE-2021-3468
CVE: CVE-2021-3468

Signed-off-by: Steve Sakoman <steve@sakoman.com>
meta/recipes-connectivity/avahi/avahi.inc
meta/recipes-connectivity/avahi/files/CVE-2021-3468.patch [new file with mode: 0644]