Skip to content
OpenAdvisories
High ALAS2-2021-1673 1 CVE

Important: gupnp security update (Amazon Linux 2)

Published Jul 1, 2021 · Updated Jul 1, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33516: A flaw was found in gupnp. DNS rebinding can occur when a victim's browser is used by a remote web server to trigger actions against local UPnP services including data exfiltration, data tempering, and other exploits. The highest threat from this vulnerability is to data confidentiality and integrity. 1964091: CVE-2021-33516 gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 gupnp 0:1.0.2-6.amzn2
Amazon Linux · 2 gupnp-debuginfo 0:1.0.2-6.amzn2
Amazon Linux · 2 gupnp-devel 0:1.0.2-6.amzn2
Amazon Linux · 2 gupnp-docs 0:1.0.2-6.amzn2

Vulnerabilities 1

  • Unscored —
    CVE-2021-33516

    An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web s…

    gupnp gupnp Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-33516.html