Debian Bug report logs - #983206
[libupnp13] Please update for CVE-2020-12695 & fixes

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Lyndon Brown <jnqnfe@gmail.com>

To: "submit@bugs.debian.org" <submit@bugs.debian.org>

Subject: [libupnp13] Please update for CVE-2020-12695 & fixes

Date: Sun, 21 Feb 2021 04:16:21 +0000

Package: libupnp13
Version: 1:1.8.4-2
Severity: critical

According to the changelog upstream version 1.14.0 includes a security
fix for CVE-2020-12695 (currently not tracked for pupnp in the debian
security tracker).

Please update to 1.14.x. Thanks.

I'm also having trouble getting DLNA working with minidlna on one
system and vlc on another, with little idea so far why it's not
working. Getting an updated libupnp13 with all the fixes they've made
may help eliminate some possible causes.

Message #10 received at 983206@bugs.debian.org (full text, mbox, reply):

From: Lyndon Brown <jnqnfe@gmail.com>

To: 983206@bugs.debian.org

Subject: Re: [libupnp13] Please update for CVE-2020-12695 & fixes

Date: Sun, 21 Feb 2021 04:57:53 +0000

On Sun, 21 Feb 2021 04:16:21 +0000 Lyndon Brown <jnqnfe@gmail.com>
wrote:
> I'm also having trouble getting DLNA working with minidlna on one
> system and vlc on another, with little idea so far why it's not
> working. Getting an updated libupnp13 with all the fixes they've made
> may help eliminate some possible causes.

Weird, having spent hours on this, I switched back to vlc after firing
off the email and the remote system was suddenly right there in vlc's
list... I can't explain that. I don't think I'd made any changes since
the last time I checked. Something I did earlier must have fixed it but
with some sort of delay to updating something. I think that the only
big difference to where I started from is no longer having minissdpd on
the server. Interestingly with it now fixed I refreshed the
x.x.x.x:8200 webpage in the browser and noticed the client type field
changed, from 'Unknown' to 'Generic UPnP 1.0'.

Hmm... Well that did not last. A little fiddling, and now it's gone
again and I'm not having any success at getting it back. The client has
also gone back to 'Unknown'. :/

Anyway, please update at least for the CVE, and fingers crossed it may
help with this also.

Message #19 received at 983206@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramcher@debian.org>

To: Lyndon Brown <jnqnfe@gmail.com>, 983206@bugs.debian.org

Subject: Re: Bug#983206: [libupnp13] Please update for CVE-2020-12695 & fixes

Date: Sat, 17 Jul 2021 22:49:31 +0200

[Message part 1 (text/plain, inline)]

Control: severity -1 grave
Control: tags -1 bullseye-ignore

On 2021-02-21 04:16:21 +0000, Lyndon Brown wrote:
> Package: libupnp13
> Version: 1:1.8.4-2
> Severity: critical
> 
> According to the changelog upstream version 1.14.0 includes a security
> fix for CVE-2020-12695 (currently not tracked for pupnp in the debian
> security tracker).
> 
> Please update to 1.14.x. Thanks.
> 
> I'm also having trouble getting DLNA working with minidlna on one
> system and vlc on another, with little idea so far why it's not
> working. Getting an updated libupnp13 with all the fixes they've made
> may help eliminate some possible causes.

https://github.com/pupnp/pupnp/commit/7b3f0f5f497f9f493c82307af495b87fa9ebdacb
is part of the fix for CVE-2020-12695 and thus libupnp requires a
transition. That will have to wait for bookworm.

Cheers
-- 
Sebastian Ramacher

[signature.asc (application/pgp-signature, inline)]

Message #28 received at 983206@bugs.debian.org (full text, mbox, reply):

From: Lyndon Brown <jnqnfe@gmail.com>

To: 983206@bugs.debian.org

Subject: Re: [libupnp13] Please update for CVE-2020-12695 & fixes

Date: Tue, 28 Sep 2021 22:43:26 +0100

With bullseye now released, can we please now progress with the
necessary transition to upgrade and thus address the security issue?

Message #33 received at 983206@bugs.debian.org (full text, mbox, reply):

From: Lyndon Brown <jnqnfe@gmail.com>

To: 983206@bugs.debian.org

Subject: Re: [libupnp13] Please update for CVE-2020-12695 & fixes

Date: Wed, 02 Feb 2022 16:04:28 +0000

@maintainer Ping.

Message #38 received at 983206@bugs.debian.org (full text, mbox, reply):

From: Lyndon Brown <jnqnfe@gmail.com>

To: 983206@bugs.debian.org, "security@debian.org" <security@debian.org>

Subject: Re: [libupnp13] Please update for CVE-2020-12695 & fixes

Date: Sun, 02 Oct 2022 23:19:32 +0100

ping.

Send a report that this bug log contains spam.