{"id":"CVE-2024-52615","title":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries","summary":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-330"],"published":"2024-11-21","updated":"2026-06-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","references":[{"url":"https://access.redhat.com/errata/RHSA-2025:11402","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:16441","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2024-52615","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326418","label":"secalert@redhat.com"},{"url":"https://github.com/avahi/avahi/pull/577","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-52615.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52615"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00622,"epssPercentile":0.49617,"ingestedAt":"2026-06-29T13:24:33.972Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)","affected":["enterprise_linux 7","enterprise_linux 8","openshift_container_platform 4","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2024-11-21T21:06:27.515199Z"},"slug":"CVE-2024-52615","body":"## Overview\n\nA flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2025:16441** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2025-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2025:16441)\n- **RHSA-2025:11402** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2025-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2025:11402)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-52615.json)","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}