CVE-2021-29462

Опубликовано: 20 апр. 2021

Источник: nvd

CVSS3: 7.6

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the Host header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.

Ссылки

http://www.openwall.com/lists/oss-security/2021/04/20/4
Mailing List
Third Party Advisory
https://github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhg
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/20/4
Mailing List
Third Party Advisory
https://github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhg
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:*

Версия до 1.14.6 (исключая)

EPSS

Процентиль: 34%

0.00137

Низкий

7.6 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-20

CWE-345

Связанные уязвимости

CVE-2021-29462

CVSS3: 7.6

ubuntu

почти 5 лет назад

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the `Host` header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.

CVE-2021-29462

CVSS3: 7.6

debian

почти 5 лет назад

The Portable SDK for UPnP Devices is an SDK for development of UPnP de ...

EPSS

Процентиль: 34%

0.00137

Низкий

7.6 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-20

CWE-345