Описание
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
Отчет
Moderate impact affects Red Hat Enterprise Linux, OpenShift Container Platform, and Red Hat In-Vehicle OS where Avahi wide-area DNS is used. Avahi sends wide-area DNS queries from a constant source port, making malicious DNS response injection and DNS spoofing easier; the Red Hat CVSS is 5.3 (Moderate). The issue is limited to wide-area DNS, and .local multicast DNS (mDNS) is not affected. For OpenShift Container Platform, remediation is deferred because the exposure is limited to this specific wide-area DNS use; residual risk remains for configurations that actively use wide-area DNS. For delegated affected streams, remediation is being pursued. Community Project Fedora streams are also affected and delegated upstream.
Меры по смягчению последствий
Configure Avahi wide-area DNS queries to be forwarded through a local DNS resolver, such as systemd-resolved, rather than sent directly by Avahi. The local resolver provides source-port randomization and reduces the risk of forged DNS responses. Apply vendor fixes when they become available.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 7 | avahi | Out of support scope | ||
| Red Hat Enterprise Linux 8 | avahi | Will not fix | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | avahi | Fixed | RHSA-2025:16441 | 23.09.2025 |
| Red Hat Enterprise Linux 9 | avahi | Fixed | RHSA-2025:11402 | 21.07.2025 |
| Red Hat Enterprise Linux 9 | avahi | Fixed | RHSA-2025:11402 | 21.07.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
A flaw was found in Avahi-daemon, which relies on fixed source ports f ...
EPSS
5.3 Medium
CVSS3