Upstream has issued an advisory on April 20: https://github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhg The issue is fixed upstream in 1.14.6. Mageia 7 and Mageia 8 are also affected.
Status comment: (none) => Fixed upstream in 1.14.6Whiteboard: (none) => MGA8TOO, MGA7TOO
Assigning to DavidG, as you did most recent versions 1.14.2, 1.14.5.
Assignee: bugsquad => geiger.david68210
Done for Cauldron and mga8! It is more complicated for mga7 as we are on 1.8 branch :(
Packages list: libupnp17-1.14.6-1.mga8 libupnp-devel-1.14.6-1.mga8 libixml11-1.14.6-1.mga8 from libupnp-1.14.6-1.mga8.src.rpm Maybe another distro has backported a fix for this. I'm over two months behind tracking distro advisories, so I'm not sure who has fixed this.
Version: Cauldron => 8Whiteboard: MGA8TOO, MGA7TOO => MGA7TOO
Advisory: ======================== Updated libupnp packages fix security vulnerability: The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the 'Host' header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later (CVE-2021-29462). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29462 https://github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhg ======================== Updated packages in core/updates_testing: ======================== libupnp13-1.8.4-3.2.mga7 libixml10-1.8.4-3.2.mga7 libupnp-devel-1.8.4-3.2.mga7 libupnp17-1.14.6-1.mga8 libupnp-devel-1.14.6-1.mga8 libixml11-1.14.6-1.mga8 from SRPMS: libupnp-1.8.4-3.2.mga7.src.rpm libupnp-1.14.6-1.mga8.src.rpm
Assignee: geiger.david68210 => qa-bugsStatus comment: Fixed upstream in 1.14.6 => (none)CC: (none) => geiger.david68210
MGA7-64 Plasma n Lenovo B50 No installation issues. No ill effects on the system.Did some reading on dependent packages like amule and ring, and decided this is out of my league. Abandoning here
CC: (none) => herman.viaene
MGA7 The following 3 packages are going to be installed: - lib64ixml10-1.8.4-3.2.mga7.x86_64 - lib64upnp-devel-1.8.4-3.2.mga7.x86_64 - lib64upnp13-1.8.4-3.2.mga7.x86_64 mediatomb is listed as using this product. --installing mediatomb The following 4 packages are going to be installed: - lib64ffmpegthumbnailer4-2.2.0-5.mga7.x86_64 - lib64mozjs185_1.0-1.85-13.mga7.x86_64 - mediatomb-0.12.1-24.mga7.x86_64 - youtube-dl-2020.05.29-1.mga7.noarch ---- I run mediatomb from command line link to audio/video through browser http://10.0.2.15:49153/ ---- mediatomb kind-a-sort-a works.
CC: (none) => brtians1Whiteboard: MGA7TOO => MGA7TOO MGA7-64-OK
MGA8 - this time Gerbera is used Note a the system was updated, but picked up some additional items The following 25 packages are going to be installed: - gcc-10.3.0-1.mga8.x86_64 - gcc-cpp-10.3.0-1.mga8.x86_64 - gerbera-1.6.4-3.mga8.x86_64 - gerbera-data-1.6.4-3.mga8.noarch - isl-0.18-2.mga8.x86_64 - lib64duktape206-2.6.0-1.mga8.x86_64 - lib64ebml5-1.4.2-1.mga8.x86_64 - lib64ffmpegthumbnailer4-2.2.2-1.mga8.x86_64 - lib64fmt-devel-7.1.3-1.mga8.x86_64 - lib64fmt7-7.1.3-1.mga8.x86_64 - lib64isl15-0.18-2.mga8.x86_64 - lib64ixml11-1.14.6-1.mga8.x86_64 - lib64matroska7-1.6.2-1.mga8.x86_64 - lib64pugixml1-1.11.4-1.mga8.x86_64 - lib64rpm9-4.16.1.3-1.1.mga8.x86_64 - lib64spdlog1-1.8.2-1.mga8.x86_64 - lib64upnp-devel-1.14.6-1.mga8.x86_64 - lib64upnp17-1.14.6-1.mga8.x86_64 - libstdc++-devel-10.3.0-1.mga8.x86_64 - libstdc++-python-devel-10.3.0-1.mga8.x86_64 - python3-rpm-4.16.1.3-1.1.mga8.x86_64 - rpm-4.16.1.3-1.1.mga8.x86_64 - rpm-plugin-ima-4.16.1.3-1.1.mga8.x86_64 - rpm-plugin-syslog-4.16.1.3-1.1.mga8.x86_64 - rpm-plugin-systemd-inhibit-4.16.1.3-1.1.mga8.x86_64 lib64upnp picked up, added the dev libraries to confirm they installed. No issues on install Gerbera worked much better than mediatomb. this is functional
Whiteboard: MGA7TOO MGA7-64-OK => MGA7TOO MGA7-64-OK MGA8-64-OK
Looks like you kinda sorta tested rpm, too. Thanks, Brian. Validating. Advisory in Comment 4.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
CC: (none) => ouaurelienCVE: (none) => CVE-2021-29462Keywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0319.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED