CVE-2020-12695

Upstream information

CVE-2020-12695 at MITRE

Description

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

---

SUSE information

Overall state of this security issue: Revisit

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	7.8
Vector	AV:N/AC:M/Au:N/C:P/I:N/A:C
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	None
Availability Impact	Complete

CVSS v3 Scores

	National Vulnerability Database
Base Score	7.5
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H
Access Vector	Network
Access Complexity	High
Privileges Required	None
User Interaction	None
Scope	Changed
Confidentiality Impact	Low
Integrity Impact	None
Availability Impact	High
CVSSv3 Version	3.1

SUSE Bugzilla entries: 1172700 [RESOLVED / FIXED], 1179447 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2020:2160-1, published Tue Feb 16 10:57:22 2021
• openSUSE-SU-2020:2194-1, published Tue Feb 16 10:57:22 2021
• openSUSE-SU-2020:2204-1, published Tue Feb 16 10:57:22 2021
• openSUSE-SU-2020:2226-1, published Tue Feb 16 10:57:22 2021
• openSUSE-SU-2021:0519-1, published Fri Apr 9 06:39:25 2021
• openSUSE-SU-2021:0545-1, published Mon Apr 12 15:39:15 2021

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub for SUSE Linux Enterprise 15 SP1	minidlna >= 1.3.0-bp151.2.3.1	Patchnames: openSUSE-2020-2226
SUSE Package Hub for SUSE Linux Enterprise 15 SP2	hostapd >= 2.9-bp152.2.3.1 minidlna >= 1.3.0-bp152.4.3.1	Patchnames: openSUSE-2020-2204 openSUSE-2021-545
openSUSE Leap 15.1	minidlna >= 1.3.0-lp151.3.3.1 minidlna-debuginfo >= 1.3.0-lp151.3.3.1 minidlna-debugsource >= 1.3.0-lp151.3.3.1	Patchnames: openSUSE-2020-2194
openSUSE Leap 15.2	hostapd >= 2.9-lp152.2.3.1 hostapd-debuginfo >= 2.9-lp152.2.3.1 hostapd-debugsource >= 2.9-lp152.2.3.1 minidlna >= 1.3.0-lp152.4.3.1 minidlna-debuginfo >= 1.3.0-lp152.4.3.1 minidlna-debugsource >= 1.3.0-lp152.4.3.1	Patchnames: openSUSE-2020-2160 openSUSE-2021-519