package/gupnp: security bump to version 1.2.6
authorFabrice Fontaine <fontaine.fabrice@gmail.com>
Tue, 1 Jun 2021 21:12:21 +0000 (23:12 +0200)
committerArnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Tue, 1 Jun 2021 21:14:50 +0000 (23:14 +0200)
commit94a3b3f062db63ed92ae38f97c49b6de2fb59c0d
tree4c8d9be31e1ebc60317db3c7cba92254009c33ef
parent2df1c10ba76fa9d8d40a438d16c40cba15ec5db6
package/gupnp: security bump to version 1.2.6

Fix CVE-2021-33516: An issue was discovered in GUPnP before 1.0.7 and
1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web
server can exploit this vulnerability to trick a victim's browser into
triggering actions against local UPnP services implemented using this
library. Depending on the affected service, this could be used for data
exfiltration, data tempering, etc.

Replace patch by upstream commit as current patch doesn't apply cleanly

https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536
https://gitlab.gnome.org/GNOME/gupnp/-/blob/gupnp-1.2.6/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
package/gupnp/0001-Revert-build-Always-build-gupnp-binding-tool-manpage.patch [deleted file]
package/gupnp/0001-doc-Check-for-stylesheet-existence-on-doc-build.patch [new file with mode: 0644]
package/gupnp/gupnp.hash
package/gupnp/gupnp.mk