avahi
avahi copied to clipboard
lathiat
New release to fix all CVEs since 2021?
Dear Avahi team, @lathiat, @evverx, @pemensik,
Current unsecure stable version is 0.8.0 (2020-02-18), 3 years, 8 months, 9 days.
It is possible to create the 0.9.0 release build to fix all CVEs (Vulnerabilities)?
- https://www.cvedetails.com/vulnerability-list/vendor_id-4481/Avahi.html
- https://cve.report/software/avahi/avahi
- ...
Current list:
- CVE-2023-38473: https://github.com/lathiat/avahi/issues/451
- CVE-2023-38472: https://github.com/lathiat/avahi/issues/452
- CVE-2023-38471: https://github.com/lathiat/avahi/issues/453
- CVE-2023-38470: https://github.com/lathiat/avahi/issues/454
- CVE-2023-38469: https://github.com/lathiat/avahi/issues/455
- CVE-2023-1981: https://github.com/lathiat/avahi/issues/375
- CVE-2021-36217
- CVE-2021-26720
- CVE-2021-3502: https://github.com/lathiat/avahi/issues/338
- CVE-2021-3468
The original tickets have been closed without the new release build:
- https://github.com/lathiat/avahi/issues/325
- https://github.com/lathiat/avahi/issues/430
Thanks in advance.
cc: @ilkery.
I have been busy working on dnsconfd project, but I think it is time for a release already. Not much new features, but a lot of important bugs already fixed. Without known regressions AFAIK. So yes, it would be nice prepare a release finally. There is still few things that needs fixing, but hopefully next release will come in summer or so. We do not have a perfect release, but it is time for a release. Ideally before FOSDEM starts.
There is still open issue #501, which seems should be fixed if possible before we release.
I thought I would do a release today, but I have to finish preparations for my fosdem talk. I have pushed tag v0.9-rc1 to allow more testing and downloading of prepared archive. There might be just few minor changes on top in final v0.9. I would like to make a release in 14 days, but have no time now to prepare decent release notes, which I want in final release. I guess for development branches of distributions rc1 would be enough.
I thought I would do a release today, but I have to finish preparations for my fosdem talk. I have pushed tag
v0.9-rc1to allow more testing and downloading of prepared archive. There might be just few minor changes on top in final v0.9. I would like to make a release in 14 days, but have no time now to prepare decent release notes, which I want in final release. I guess for development branches of distributions rc1 would be enough.
Hello @pemensik, any news on the 0.9 release? Thanks.
Sorry, still busy with bind9 CVE fixes on RHEL, which are my top priority for the moment.
I haven't forgotten, we have a new CVE-2024-2699 for issue #501, but more similar issues are coming. We need to improve also tracking of security related issues, for which I have not sufficient access here.
