OESA-2021-1272

Dashboard / Vulnerabilities / OESA-2021-1272

OESA-2021-1272

Summary: gupnp security update

Details: GUPnP is an elegant, object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible. It provides the same set of features as libupnp,but shields the developer from most of UPnP's internals. Security Fix(es): An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.(CVE-2021-33516)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1272, https://nvd.nist.gov/vuln/detail/CVE-2021-33516