File _patchinfo of Package patchinfo.18197

<patchinfo incident="18197">
  <issue tracker="bnc" id="1180827">VUL-0: CVE-2021-26720: EMBARGOED: avahi: outdated and insecure if-up script avahi-daemon-check-dns.sh</issue>
  <issue tracker="bnc" id="1184521">VUL-0: CVE-2021-3468: avahi: local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket</issue>
  <issue tracker="cve" id="2021-3468"/>
  <issue tracker="cve" id="2021-26720"/>
  <packager>mgorse</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for avahi</summary>
  <description>This update for avahi fixes the following issues:

- CVE-2021-3468: avoid infinite loop by handling  HUP event in client_work (bsc#1184521).
- CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)
- Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d.
- Add sudo to requires: used to drop privileges.
</description>
</patchinfo>