avahi: Please update Avahi to fix several CVEs

[Neustradamus]

Package Name

avahi

Maintainer

No maintainer but all contributors: @graysky2, @neheb, @nxhack, @paper42, @lipnitsk, @neheb, @dl12345, @jsmcconn, @neocturne, @champtar, @thess, @cbrasho, @commodo, @dangowrt, @mhei, @sbyx, Noltari.

OpenWrt Version

main

OpenWrt Target/Subtarget

Steps to Reproduce

OpenWrt source:

• https://github.com/openwrt/packages/tree/master/libs/avahi

Avahi source:

• https://github.com/avahi/avahi
• https://github.com/avahi

To solve several CVEs, it is the moment to use Avahi 0.9-rc2 (2024-11-19), one year ago:

• https://github.com/avahi/avahi/tags

Or to use a git tag.

It will replace the unsecure Avahi 0.8 (2020-02-18), soon 6 years, which has a lot of CVEs.

Linked to:

• New version, 0.9 ? avahi/avahi#325
• is there a plan for v0.9 tag? avahi/avahi#430
• New release to fix all CVEs since 2021? avahi/avahi#503
• new release? 🤔 avahi/avahi#550
• Release v0.8.1 with critical bugfixes avahi/avahi#558

Thanks in advance.

Actual Behaviour

Please read previously.

Confirmation Checklist

• The package is maintained in this repository.
• I understand that issues related to the base OpenWrt repository or LuCI repository will be closed.
• I am reporting an issue for OpenWrt, not an unsupported fork.

[graysky2]

A number of the CVEs are in fact patched in the current version but I agree that we should update.

[nxhack]

https://security-tracker.debian.org/tracker/source-package/avahi
All past patches for Debian appear to have been applied.
The latest
CVE-2024-52615
CVE-2024-52616
seem to be unaddressed.

enable-wide-area=no

appears to be a workaround.