CVE-2020-12695

NameCVE-2020-12695
DescriptionThe Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2315-1, DLA-2318-1, DLA-2489-1, DSA-4806-1, DSA-4898-1, ELA-240-1, ELA-258-1
Debian Bugs976106, 976594, 983206

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gupnp (PTS)jessie, jessie (lts)0.20.12-1+deb8u1fixed
stretch (security), stretch (lts), stretch1.0.1-1+deb9u1fixed
buster1.0.5-0+deb10u1fixed
bullseye1.2.4-1fixed
bookworm1.6.3-1fixed
sid, trixie1.6.6-1fixed
libupnp (PTS)jessie, jessie (lts)1:1.6.19+git20141001-1+deb8u2vulnerable
stretch (security), stretch (lts), stretch1:1.6.19+git20160116-1.2+deb9u1vulnerable
minidlna (PTS)jessie, jessie (lts)1.1.2+dfsg-1.1+deb8u1vulnerable
stretch (security), stretch (lts), stretch1.1.6+dfsg-1+deb9u2fixed
buster1.2.1+dfsg-2+deb10u3fixed
buster (security)1.2.1+dfsg-2+deb10u4fixed
bullseye (security), bullseye1.3.0+dfsg-2+deb11u2fixed
bookworm (security), bookworm1.3.0+dfsg-2.2+deb12u1fixed
sid, trixie1.3.3+dfsg-1fixed
pupnp (PTS)trixie1:1.14.18-1fixed
sid1:1.14.18-1.1fixed
pupnp-1.8 (PTS)buster, bullseye, bookworm1:1.8.4-2vulnerable
wpa (PTS)jessie, jessie (lts)2.3-1+deb8u13fixed
stretch (security), stretch (lts), stretch2:2.4-1+deb9u9fixed
buster2:2.7+git20190128+0c1e29f-6+deb10u3fixed
buster (security)2:2.7+git20190128+0c1e29f-6+deb10u4fixed
bullseye2:2.9.0-21fixed
bookworm2:2.10-12fixed
sid, trixie2:2.10-21fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gupnpsourcewheezy(unfixed)end-of-life
gupnpsourcejessie0.20.12-1+deb8u1ELA-258-1
gupnpsourcestretch1.0.1-1+deb9u1DLA-2315-1
gupnpsourcebuster1.0.5-0+deb10u1
gupnpsource(unstable)1.2.3-1
libupnpsourcejessie(unfixed)end-of-life
libupnpsource(unstable)(unfixed)
minidlnasourcejessie(unfixed)end-of-life
minidlnasourcestretch1.1.6+dfsg-1+deb9u1DLA-2489-1
minidlnasourcebuster1.2.1+dfsg-2+deb10u1DSA-4806-1
minidlnasource(unstable)1.2.1+dfsg-3976594
pupnpsource(unstable)(not affected)
pupnp-1.8source(unstable)(unfixed)983206
wpasourcewheezy(unfixed)end-of-life
wpasourcejessie2.3-1+deb8u11ELA-240-1
wpasourcestretch2:2.4-1+deb9u7DLA-2318-1
wpasourcebuster2:2.7+git20190128+0c1e29f-6+deb10u3DSA-4898-1
wpasource(unstable)2:2.9.0-16976106

Notes

- pupnp <not-affected> (Fixed before initial upload to Debian after source package rename)
[bookworm] - pupnp-1.8 <no-dsa> (Minor issue)
[bullseye] - pupnp-1.8 <no-dsa> (Minor issue)
[buster] - pupnp-1.8 <no-dsa> (Minor issue)
[stretch] - libupnp <no-dsa> (Invasive change, hard to backport; chances of regression)
https://w1.fi/security/2020-1/upnp-subscribe-misbehavior-wps-ap.txt
https://w1.fi/security/2020-1/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch
https://w1.fi/security/2020-1/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch
https://w1.fi/security/2020-1/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch
https://sourceforge.net/p/minidlna/git/ci/06ee114731612462eb1eb1266f0431ccf59269d2 (v1_3_0)
https://github.com/pupnp/pupnp/commit/5f76bf2858dd601bd985bf37a1db9f262c0ff7bf (release-1.14.0)
https://github.com/pupnp/pupnp/commit/7b3f0f5f497f9f493c82307af495b87fa9ebdacb (release-1.14.0)

Search for package or bug name: Reporting problems