Red Hat Avahi-daemon Predictable DNS Transaction ID Vulnerability (CVE-2024-52616)

Key Information Vulnerability Description CVE Number: CVE-2024-52616 Public Disclosure Date: November 15, 2024 Last Modified Date: November 15, 2024 Impact Level: Medium CVSS v3 Score: 5.3 Vulnerability Details Description: A flaw in avahi-daemon where the DNS transaction ID is randomly initialized at startup and incremented only once after startup. This predictable behavior enables DNS spoofing attacks, allowing attackers to guess the transaction ID. Additional Information Bugzilla ID: 2326429 CWE ID: 334 Affected Packages and Red Hat Security Fixes Affected Products: - Red Hat Enterprise Linux 7 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat OpenShift Container Platform 4 CVSS v3 Score Details CVSS v3 Base Score: 5.3 Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality Impact: None Integrity Impact: Low Availability Impact: None Frequently Asked Questions Why does Red Hat’s CVSS v3 score or impact differ from other vendors? My product is listed as “under investigation” or “affected.” When will Red Hat release a fix for this vulnerability? If my product is listed as “not fixed,” what should I do? If my product is listed as “fix delayed,” what should I do? I have a Red Hat product, but it’s not listed above. Is it affected? Why does my security scanner report this vulnerability on my product, even though my product version is fixed or unaffected? My product is listed as “out of support.” What does this mean? Additional Information External Reference: CVE-2024-52616 NVD Reference: CVE-2024-52616 Disclaimer: This page was automatically generated and has not been checked for errors or omissions. For questions, please contact Red Hat Product Security.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat Avahi-daemon Predictable DNS Transaction ID Vulnerability (CVE-2024-52616)

More from this source