CVE-2021-29462

DNS rebinding in pupnp

State: Published
Severity: 7.6 High
Published: Apr 20, 2021
Updated: Aug 3, 2024
Reserved: Mar 30, 2021

Description

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the `Host` header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.

Scores

CVSS	Score	Vector	Source
3.1	7.6 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L	GitHub_M

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
pupnppupnp	< 1.14.6Affected

References

https://github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhg
[oss-security] 20210420 DNS rebinding vulnerability in pupnpmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.