import avahi-0.7-27.el8_10.1

SOURCES/0001-Do-not-disable-timeout-cleanup-on-watch-cleanup.patch

@@ -0,0 +1,28 @@
+From bbf47e831143dc87c90811f404ccbae580930ff0 Mon Sep 17 00:00:00 2001
+From: Gustavo Noronha Silva <gustavo@noronha.dev.br>
+Date: Sun, 2 Jan 2022 22:29:04 -0300
+Subject: [PATCH] Do not disable timeout cleanup on watch cleanup
+
+This was causing timeouts to never be removed from the linked list that
+tracks them, resulting in both memory and CPU usage to grow larger over
+time.
+---
+ avahi-common/simple-watch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/avahi-common/simple-watch.c b/avahi-common/simple-watch.c
+index 08d8090..2a4a989 100644
+--- a/avahi-common/simple-watch.c
++++ b/avahi-common/simple-watch.c
+@@ -238,7 +238,7 @@ static void cleanup_watches(AvahiSimplePoll *s, int all) {
+             destroy_watch(w);
+     }
+ 
+-    s->timeout_req_cleanup = 0;
++    s->watch_req_cleanup = 0;
+ }
+ 
+ static AvahiTimeout* timeout_new(const AvahiPoll *api, const struct timeval *tv, AvahiTimeoutCallback callback, void *userdata) {
+-- 
+2.45.2
+

SOURCES/0001-fix-memory-leak-in-wide-area-lookup.patch

@@ -0,0 +1,24 @@
+From 93de55227583a149a375f529f3fafafae7c2c3bb Mon Sep 17 00:00:00 2001
+From: Wei Li <wei.li@calix.com>
+Date: Fri, 23 Dec 2022 17:02:53 +0800
+Subject: [PATCH] fix memory leak in wide area lookup
+
+---
+ avahi-core/wide-area.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/avahi-core/wide-area.c b/avahi-core/wide-area.c
+index d5e64e5..971f5e7 100644
+--- a/avahi-core/wide-area.c
++++ b/avahi-core/wide-area.c
+@@ -564,6 +564,7 @@ static void socket_event(AVAHI_GCC_UNUSED AvahiWatch *w, int fd, AVAHI_GCC_UNUSE
+     if (p) {
+         handle_packet(e, p);
+         avahi_dns_packet_free(p);
++        avahi_cleanup_dead_entries(e->server);
+     }
+ }
+ 
+-- 
+2.45.2
+

SPECS/avahi.spec

@@ -26,7 +26,7 @@
 
 Name:             avahi
 Version:          0.7
-Release:          21%{?dist}.1
+Release:          27%{?dist}.1
 Summary:          Local network service discovery
 License:          LGPLv2+
 URL:              http://avahi.org
@@ -96,6 +96,8 @@ Patch0011:  0001-core-extract-host-name-using-avahi_unescape_label.patch
 Patch0012:  0001-core-return-errors-from-avahi_server_set_host_name-p.patch
 Patch0013:  0001-core-reject-overly-long-TXT-resource-records.patch
 Patch0014:  0001-Avoid-infinite-loop-in-avahi-daemon-by-handling-HUP-.patch
+Patch0015:  0001-Do-not-disable-timeout-cleanup-on-watch-cleanup.patch
+Patch0016:  0001-fix-memory-leak-in-wide-area-lookup.patch
 
 ## downstream patches
 Patch100:         avahi-0.6.30-mono-libdir.patch
@@ -510,7 +512,7 @@ exit 0
 %ghost %{_sysconfdir}/avahi/etc/localtime
 %config(noreplace) %{_sysconfdir}/avahi/hosts
 %dir %{_sysconfdir}/avahi/services
-%ghost %dir %{_localstatedir}/run/avahi-daemon
+%ghost %attr(0755, avahi, avahi) %dir %{_localstatedir}/run/avahi-daemon
 %config(noreplace) %{_sysconfdir}/avahi/avahi-daemon.conf
 %config(noreplace) %{_sysconfdir}/dbus-1/system.d/avahi-dbus.conf
 %{_sbindir}/avahi-daemon
@@ -664,13 +666,27 @@ exit 0
 
 
 %changelog
-* Wed Dec 06 2023 Michal Sekletar <msekleta@redhat.com> - 0.7-21.1
+* Tue Aug 27 2024 Michal Sekletar <msekleta@redhat.com> - 0.7-27.1
-- Fix CVE-2021-3468 (RHEL-18311)
+- fix file attributes for /run/avahi-daemon (RHEL-5631)
-- Fix CVE-2023-38469 (RHEL-17783)
+- fix two memory leaks (RHEL-43458)
-- Fix CVE-2023-38470 (RHEL-17795)
+
-- Fix CVE-2023-38471 (RHEL-17789)
+* Thu Nov 09 2023 Michal Sekletar <msekleta@redhat.com> - 0.7-27
-- Fix CVE-2023-38472 (RHEL-17807)
+- Fix CVE-2021-3468 (RHEL-9542)
-- Fix CVE-2023-38473 (RHEL-17801)
+
+* Thu Nov 09 2023 Michal Sekletar <msekleta@redhat.com> - 0.7-26
+- Fix CVE-2023-38469 (RHEL-5635)
+
+* Thu Nov 09 2023 Michal Sekletar <msekleta@redhat.com> - 0.7-25
+- Fix CVE-2023-38471 (RHEL-5639)
+
+* Thu Nov 09 2023 Michal Sekletar <msekleta@redhat.com> - 0.7-24
+- Fix CVE-2023-38473 (RHEL-5643)
+
+* Thu Nov 09 2023 Michal Sekletar <msekleta@redhat.com> - 0.7-23
+- Fix CVE-2023-38472 (RHEL-5644)
+
+* Thu Nov 09 2023 Michal Sekletar <msekleta@redhat.com> - 0.7-22
+- Fix CVE-2023-38470 (RHEL-5640)
 
 * Wed Aug 23 2023 Michal Sekletar <msekleta@redhat.com> - 0.7-21
 - Fix CVE-2023-1981 (#2186688)