Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 20 Apr 2021 22:35:17 +0200
From: Gabriel Corona <gabriel.corona@...t-bretagne.fr>
To: oss-security@...ts.openwall.com
Subject: DNS rebinding vulnerability in pupnp

The server-part of pupnp, a library used to implement UPnP clients and
servers, is vulnerable to DNS rebinding attacks.

Impact: A remote web server can exploit this vulnerability to trick the
user browser into triggering actions on the local UPnP services
implemented using this library or exfiltrate resources exposed using the
embedded web server.

This is fixed in v1.14.6

This is CVE-2021-29462.

References:

https://github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhg
https://github.com/pupnp/pupnp

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.