Medium [CVE-2024-52615] Avahi: avahi wide-area dns uses constant source port
This medium-severity Red Hat Linux advisory covers CVE-2024-52615 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
Moderate impact affects Red Hat Enterprise Linux, OpenShift Container Platform, and Red Hat In-Vehicle OS where Avahi wide-area DNS is used. Avahi sends wide-area DNS queries from a constant source port, making malicious DNS response injection and DNS spoofing easier; the Red Hat CVSS is 5.3 (Moderate).
The issue is limited to wide-area DNS, and.local multicast DNS (mDNS) is not affected. For OpenShift Container Platform, remediation is deferred because the exposure is limited to this specific wide-area DNS use; residual risk remains for configurations that actively use wide-area DNS.
For delegated affected streams, remediation is being pursued. Community Project Fedora streams are also affected and delegated upstream.
Weakness: CWE-330. Will not fix / out of support: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8.
Red Hat fixing advisory: RHSA-2025:16441, RHSA-2025:11402.
Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: avahi.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 20 hours ago·verify at source
- avahi-0:0.9~rc2-1.el10_0.1
- avahi-0:0.8-22.el9_6.1
- RHSA-2025:16441
- RHSA-2025:11402
Official advisory · high-confidence parse· fetched 20 hours ago·verify at source
Mitigation checklist
- Configure Avahi wide-area DNS queries to be forwarded through a local DNS resolver, such as systemd-resolved, rather than sent directly by Avahi. The local resolver provides source-port randomization and reduces the risk of forged DNS responses. Apply vendor fixes when they become available.
Official advisory · high-confidence parse· fetched 20 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.