CVE-2017-6519

What it actually does

Inadvertent response to IPv6 unicast queries with off-link source addresses on UDP port 5353, enabling traffic amplification and potential sensitive information disclosure.

Why it matters to the business

Risk of service disruption from amplification attacks and unauthorized exposure of device information, raising operational overhead and compliance concerns in affected deployments.

How an attack unfolds

An attacker sends crafted IPv6 unicast packets to UDP port 5353 using source addresses not present on the local link; the service responds with amplified traffic that can be directed elsewhere for denial of service or used to harvest information from the replying system.

How to fix it

Upgrade elasticsearch-8 (Chainguard) to 8.13.2-r1 or later and elasticsearch-config (Chainguard) to 8.13.2-r1 or later; restrict or disable unnecessary mDNS/Avahi exposure until patches are applied.

How to confirm the fix worked

Confirm installed package versions meet or exceed the listed fixed releases; perform network tests to verify the service no longer answers off-link unicast queries.

Typical attack path

1. Identify exposed instances listening on UDP 5353
2. Craft IPv6 unicast queries with non-local source addresses
3. Observe amplified responses for traffic reflection or data collection

How to detect it

Review network flow logs and service logs for high volumes of unicast IPv6 responses on UDP port 5353; correlate with external query sources that should not elicit replies.

What your security team should do

• Apply the exact package upgrades without delay given the public exploit availability
• Block or rate-limit inbound UDP 5353 traffic from untrusted networks
• Audit configurations to ensure only on-link multicast queries are accepted