PT-2021-21182 · Avahi · Avahi

Published 2021-07-07 · Updated 2021-08-19 · CVE-2021-36217

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Avahi version 0.8

Description The issue allows a local denial of service, resulting in a NULL pointer dereference and daemon crash against avahi-daemon. This can be achieved via the D-Bus interface or by executing a ping .local command.

Recommendations For Avahi version 0.8, consider restricting access to the D-Bus interface and avoid using the ping .local command until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-36217

OESA-2021-1273

Affected Products

Avahi

References · 8

• https://osv.dev/vulnerability/ALPINE-CVE-2021-36217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36217 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36217 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1273 · Vendor Advisory
• https://t.me/cvenotify/18825 · Telegram Post
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1273 · Note
• https://t.me/cibsecurity/25987 · Telegram Post
• https://security.alpinelinux.org/vuln/CVE-2021-36217 · Note