[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] DNS rebinding vulnerability in pupnp
From:       Gabriel Corona <gabriel.corona () enst-bretagne ! fr>
Date:       2021-04-20 20:35:17
Message-ID: bfe1a38e-f10a-cc67-d0f2-05089977383c () enst-bretagne ! fr
[Download RAW message or body]

The server-part of pupnp, a library used to implement UPnP clients and
servers, is vulnerable to DNS rebinding attacks.

Impact: A remote web server can exploit this vulnerability to trick the
user browser into triggering actions on the local UPnP services
implemented using this library or exfiltrate resources exposed using the
embedded web server.

This is fixed in v1.14.6

This is CVE-2021-29462.

References:

https://github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhg
https://github.com/pupnp/pupnp
[prev in list] [next in list] [prev in thread] [next in thread]