New release to fix all CVEs since 2021?

[Neustradamus]

Dear Avahi team, @lathiat, @evverx, @pemensik,

Current unsecure stable version is 0.8.0 (2020-02-18), 3 years, 8 months, 9 days.

It is possible to create the 0.9.0 release build to fix all CVEs (Vulnerabilities)?

• https://www.cvedetails.com/vulnerability-list/vendor_id-4481/Avahi.html
• https://cve.report/software/avahi/avahi
• ...

Current list:

• CVE-2023-38473: Reachable assertion in avahi_alternative_host_name #451
• CVE-2023-38472: Reachable assertion in avahi_rdata_parse #452
• CVE-2023-38471: Reachable assertion in dbus_set_host_name #453
• CVE-2023-38470: Reachable assertion in avahi_escape_label #454
• CVE-2023-38469: Reachable assertion in avahi_dns_packet_append_record #455
• CVE-2023-1981: avahi-daemon can be crashed via DBus #375
• CVE-2021-36217
• CVE-2021-26720
• CVE-2021-3502: reachable assertion in avahi_s_host_name_resolver_start when trying to resolve badly-formatted hostnames (CVE-2021-3502) #338
• CVE-2021-3468

The original tickets have been closed without the new release build:

• New version, 0.9 ? #325
• is there a plan for v0.9 tag? #430

Thanks in advance.

cc: @ilkery.

[pemensik]

I have been busy working on dnsconfd project, but I think it is time for a release already. Not much new features, but a lot of important bugs already fixed. Without known regressions AFAIK. So yes, it would be nice prepare a release finally. There is still few things that needs fixing, but hopefully next release will come in summer or so. We do not have a perfect release, but it is time for a release. Ideally before FOSDEM starts.

[pemensik]

There is still open issue #501, which seems should be fixed if possible before we release.

[pemensik]

I thought I would do a release today, but I have to finish preparations for my fosdem talk. I have pushed tag v0.9-rc1 to allow more testing and downloading of prepared archive. There might be just few minor changes on top in final v0.9. I would like to make a release in 14 days, but have no time now to prepare decent release notes, which I want in final release. I guess for development branches of distributions rc1 would be enough.

[xypiie]

I thought I would do a release today, but I have to finish preparations for my fosdem talk. I have pushed tag v0.9-rc1 to allow more testing and downloading of prepared archive. There might be just few minor changes on top in final v0.9. I would like to make a release in 14 days, but have no time now to prepare decent release notes, which I want in final release. I guess for development branches of distributions rc1 would be enough.

Hello @pemensik, any news on the 0.9 release? Thanks.

[pemensik]

Sorry, still busy with bind9 CVE fixes on RHEL, which are my top priority for the moment.

I haven't forgotten, we have a new CVE-2024-2699 for issue #501, but more similar issues are coming. We need to improve also tracking of security related issues, for which I have not sufficient access here.

[jberkus]

What's the status of this? Seems like there's still no release?

[Neustradamus]

Dear @avahi team, @lathiat, @evverx, @pemensik,

We are 2024-06-26, currently, it is not secure and very old, the 0.8.0 has been released 2020-02-18 (more 4 years and 4 months).

Have you progressed for a new release build?
It is urgent to have with CVE fixes...

It is possible to create more release builds like other projects.

Thanks in advance.

[nairboon]

At this point avahi should add some new maintainers or declare it as deprecated. Then the solution might be to fork avahi.
Now it is really 4 years that avahi sits on fixes, but doesn't release them, like issue #210 which makes avahi quite unusable in large networks.

[Neustradamus]

@nairboon: Since several years, I have tried to relive this project, I have permit to have an organization to improve it...

But there is a problem with current team -> always CVEs badly.
The project is not secure... :/

No new releases since 2020.

Same for nss-mdns:

• Make new release nss-mdns#85

[evverx]

CVE-2021-26720

GHSA-jhxr-wvf5-hrp6 is Debian-specific.

The other CVEs are local DoSes (unless D-Bus is exposed over the network as in https://spectrum.ieee.org/jeep-hacking-101 but thanks to that non-local sockets were officially deprecated and the dbus-daemon manpage comes with huge warnings like https://gitlab.freedesktop.org/dbus/dbus/-/blob/master/doc/dbus-daemon.1.xml.in?ref_type=heads#L462 so if there are devices where D-Bus is exposed over the network they certainly have more serious issues than the avahi DoSes).

In other words those things aren't urgent. Distros where those things are important have already backported all the patches and aren't affected.

At this point avahi should add some new maintainers or declare it as deprecated. Then the solution might be to fork avahi.

It isn't deprecated but vendors who have the resources to maintain their forks with their patches on top already do that so it shouldn't be necessary to wait for anything to start doing that too.

Either way my understanding is that the release is kind of blocked because it hasn't been decided what should be deprecated and dropped entirely. Distros like Debian and NixOS are fine with dropping some things but Fedora disagrees and it isn't obvious what should be included in the release notes. Once it's decided it should be fine to write the release notes and cut the release.

[xypiie]

Hello @pemensik, half a year has passed since my last question. Any news on the 0.9 release? :) Thanks.