From 10557b50b5e7d25289dbbbeea8ee6bab9acc2c3f Mon Sep 17 00:00:00 2001 From: Samuel Dionne-Riel Date: Wed, 8 Apr 2026 10:09:37 -0400 Subject: [PATCH] avahi: Add commented-out `knownVulnerabilities` for CVE-2024-52615 It would be better if there was a way to mark those mitigated issues in a way that can be machine-consumed, without causing the package to be marked insecure. In actuality, the `insecure` bit for this particular vulnerability would dpeend on the daemon configuration. The package itself cannot depend on the system configuration. A warning could be added to the NixOS module when the mitigation is disabled. --- pkgs/by-name/av/avahi/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/av/avahi/package.nix b/pkgs/by-name/av/avahi/package.nix index 630a4f398315..a7eb3b7b0bb6 100644 --- a/pkgs/by-name/av/avahi/package.nix +++ b/pkgs/by-name/av/avahi/package.nix @@ -251,5 +251,10 @@ stdenv.mkDerivation rec { DNS") and DNS-SD (for "DNS-Based Service Discovery") protocols. ''; + + knownVulnerabilities = [ + # NOTE: CVE-2024-52615 mitigated by the default NixOS configuration. + # "CVE-2024-52615: Avahi Wide-Area DNS Uses Constant Source Port" + ]; }; }