Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

Mageia 7 & 8: MGASA-2021-0321 Critical GUPnP DNS Rebinding Risk

mageia
Calendar Grey July 8, 2021
Dist Mageia Esm H88
Recent updates to gupnp packages in Mageia address a DNS rebinding flaw that could enable unwanted data exposure.
An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5

Summary

An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc. (CVE-2021-33516)

References

- https://bugs.mageia.org/show_bug.cgi?id=29085

- https://ubuntu.com/security/notices/USN-4970-1

- https://access.redhat.com/errata/RHSA-2021:2363

- https://www.cve.org/CVERecord?id=CVE-2021-33516

Topics%20covered

Topics Covered

security advisory critical data exfiltration Mageia DNS Rebinding GUPnP

Resolution

SRPMS

- 8/core/gupnp-1.2.4-1.1.mga8

- 7/core/gupnp-1.2.3-1.1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 08 Jul 2021
URL: https://advisories.mageia.org/MGASA-2021-0321.html
Type: security
CVE: CVE-2021-33516

Topics%20covered

Topics Covered

security advisory critical data exfiltration Mageia DNS Rebinding GUPnP

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here