ALT-PU-2021-4940

Критический

ALT-PU-2021-4940: package libupnp update to version 1.14.10-alt1

Источник

errata.altlinux.org

Дата публикации

20.09.2021

Дата обновления

20.09.2021

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades libupnp to version 1.14.10-alt1.

Устраненные уязвимости1

CVE-2021-29462

Критический 9.8

Дата публикации: 20.04.2021

CWE-345

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the Host header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.

CVSS 3.1

Критический 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Высокий 7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Ссылки

CVE-2021-29462 https://nvd.nist.gov/vuln/detail/CVE-2021-29462

Ссылки1

ALT-PU-2021-4940 https://errata.altlinux.org/ALT-PU-2021-4940

Связанные уязвимости

CVE-2021-29462

CVSS3: 9.8

ubuntu

больше 5 лет назад

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the `Host` header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.

CVE-2021-29462

CVSS3: 9.8

nvd

больше 5 лет назад

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the `Host` header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.

CVE-2021-29462

CVSS3: 9.8

debian

больше 5 лет назад

The Portable SDK for UPnP Devices is an SDK for development of UPnP de ...