[CLSA-2026:1787932412] Fix CVE(s): CVE-2021-26720
Type:
security
Severity:
Important
Release date:
2026-08-29 10:28:02 UTC
Description:
* SECURITY UPDATE: local symlink attack through the unicast .local DNS check: /etc/network/if-up.d/avahi-daemon exec's /usr/lib/avahi/avahi-daemon-check-dns.sh as root, and the script writes into /run/avahi-daemon (the checked_nameservers[.$$] cache and the disabled-for-unicast-local tag) without protecting against symlinks, so a local attacker able to place symlinks in that avahi-owned directory can make root create arbitrary empty files or cause a denial of service. - debian/avahi-daemon.if-up: run the check script under "sudo -u avahi -g avahi" instead of exec'ing it as root, so the writes are performed by the same unprivileged account that owns /run/avahi-daemon. Backported verbatim from Debian stretch 0.6.32-2+deb9u1 (DLA-3047-1); the alternative vendor fix, dropping the check-dns mechanism outright (Debian buster 0.7-4+deb10u1, Ubuntu focal 0.7-4ubuntu7), is not applicable here because bionic ships libnss-mdns 0.10-8ubuntu1, the same generation as stretch. - debian/control: add sudo to the avahi-daemon Depends, required by the privilege drop. - CVE-2021-26720
CVEs fixed:
Updated packages:
  • avahi-autoipd_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:def4963c3d1a85baacd970568667e2b1b23910f3
  • avahi-daemon_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:0a0e787d0f8630fb098492689dfb351f5635d65d
  • avahi-discover_0.7-3.1ubuntu1.3+tuxcare.els1_all.deb
    sha:dbc39578e23de77c46971e35ac7e51ad0463df7c
  • avahi-dnsconfd_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:36654d7fd9442563cd2a2b7b8b334543705e6be0
  • avahi-ui-utils_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:9a5b9b746dea4a1c561a91b1ec6ecf7ad8939c5e
  • avahi-utils_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:917028a8c80325d481a67361c30b7c8465f70bfd
  • gir1.2-avahi-0.6_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:4c55b3f396c9765fba840a1f2781c979ce903c9a
  • libavahi-client-dev_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:cd2a4b82c33ceaa7de26418663f8c5858545a978
  • libavahi-client3_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:d48dd312acfbe5fe3fcab1089762cd19b2058893
  • libavahi-common-data_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:92cf6753d60034326617cec175846ed26fdb39d2
  • libavahi-common-dev_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:dfc1ff0a205d87e927377ea8fc6d6f4c9f4d1655
  • libavahi-common3_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:52f363f8d1229036dfa757c782d9727c29fdbd95
  • libavahi-compat-libdnssd-dev_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:5d695aeb132485ea5e56f0fcffd32a81aa82f627
  • libavahi-compat-libdnssd1_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:b3871cde0f7a2f3417bdf38f7ec44c88c37c27f1
  • libavahi-core-dev_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:e0f7832296b6670ba26a01ff7c4cb01bd31e5432
  • libavahi-core7_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:99006708e9a8b84764fa524905d2e770e13cbc94
  • libavahi-glib-dev_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:12787a51b602be90f55329d82c352cf7b693f41a
  • libavahi-glib1_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:cd5f8df9134bc29604620ccfddb6584f58ada581
  • libavahi-gobject-dev_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:52ac1c70a72a6863c5d393aa9741357285f6a0c3
  • libavahi-gobject0_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:c91af18983a0e55f9ad08efba7278be6b3741c84
  • libavahi-ui-gtk3-0_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:4b4f21b086b7f88ae5e552d1d8ebac934c0d940d
  • libavahi-ui-gtk3-dev_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:d420b41e20da745a0eafb517a7a0776b347e1b41
  • python-avahi_0.7-3.1ubuntu1.3+tuxcare.els1_amd64.deb
    sha:549bafa67bc35c22f4763949defd27801b8fe45a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.