GNU bug report logs - #47140
libupnp package vulnerable to CVE-2021-28302

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Mark H Weaver <mhw <at> netris.org>
Subject: bug#47140: closed (libupnp package vulnerable to CVE-2021-28302)
Date: Fri, 09 Apr 2021 01:17:02 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#47140: libupnp package vulnerable to CVE-2021-28302

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 47140 <at> debbugs.gnu.org.

-- 
47140: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=47140
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Léo Le Bouter <lle-bout <at> zaclys.net>
To: 47140-done <at> debbugs.gnu.org
Subject: libupnp package vulnerable to CVE-2021-28302
Date: Fri, 09 Apr 2021 03:16:11 +0200

[Message part 3 (text/plain, inline)]

Fixed by 2b605ef3b145ec136530f08ee7aa27382aa64b46

[signature.asc (application/pgp-signature, inline)]

[Message part 5 (message/rfc822, inline)]

From: Mark H Weaver <mhw <at> netris.org>
To: bug-guix <at> gnu.org
Cc: Léo Le Bouter <lle-bout <at> zaclys.net>
Subject: libupnp package vulnerable to CVE-2021-28302
Date: Sun, 14 Mar 2021 17:29:06 -0400

[Message part 6 (text/plain, inline)]

I'm forwarding this to bug-guix <at> gnu.org so that it won't be forgotten.

       Mark

-------------------- Start of forwarded message --------------------
Subject: libupnp package vulnerable to CVE-2021-28302
From: Léo Le Bouter <lle-bout <at> zaclys.net>
To: guix-devel <at> gnu.org
Date: Sat, 13 Mar 2021 02:12:45 +0100

[Message part 7 (text/plain, inline)]

CVE-2021-28302	12.03.21 16:15
A stack overflow in pupnp 1.16.1 can cause the denial of service
through the Parser_parseDocument() function. ixmlNode_free() will
release a child node recursively, which will consume stack space and
lead to a crash.

Upstream did not provide a patch yet, see <
https://github.com/pupnp/pupnp/issues/249>.

I suggest we wait for the patch to be made and then update, to be
monitored.

[signature.asc (application/pgp-signature, inline)]

[Message part 9 (text/plain, inline)]

-------------------- End of forwarded message --------------------

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.