Stay Secure with the Latest Linux Advisories

security advisorynetwork threatmageia

Mageia: 2020-0304 Moderate: gssdp/gupnp Subscription Request Risk

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. (CVE-2020-12695). . MGASA-2020-0304 - Updated gssdp/gupnp packages fix security vulnerability Publication date: 31 Jul 2020 URL: https://advisories.mageia.org/MGASA-2020-0304.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-12695 The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. (CVE-2020-12695). References: - https://bugs.mageia.org/show_bug.cgi?id=26918 - https://mail.gnome.org/archives/gupnp-list/2020-June/msg00000.html - https://www.cve.org/CVERecord?id=CVE-2020-12695 SRPMS: - 7/core/gssdp-1.2.3-1.mga7 - 7/core/gupnp-1.2.3-1.mga7 . Newly released gssdp/gupnp updates mitigate CallStranger flaw in Mageia. Security notice issued on 31 July 2020.. gupnp security, mageia update, gssdp vulnerability, CallStranger issue. . Severity: Important. LinuxSecurity.com Team

Jul 31, 2020 •Important Mageia