The UPnP protocol specification mandates that subscribers can request a callback to an arbitrary URL. This recently resulted in CVE-2020-12695 (CallStranger) outlining the risk of information disclosure and DoS attacks. This commit ensures that the callback URL sent in a SUBSCRIBE request points to the same IP address that made the request.
MiniDLNA project (c) 2009 Justin Maggard Portions (c) 2006-2007 Thomas Bernard webpage: http://sourceforge.net/projects/minidlna/ This directory contains the MiniDLNA daemon software. This software is subject to the conditions detailed in the LICENCE file provided with this distribution. Parts of the software including the discovery code are licensed under the BSD revised license which is detailed in the LICENSE.miniupnpd file provided with the distribution. More information on MiniUPnPd can be found at http://miniupnp.free.fr. The MiniDLNA daemon is an UPnP-A/V and DLNA service which serves multimedia content to compatible clients on the network. See http://www.upnp.org/ for more details on UPnP and http://www.dlna.org/ for mode details on DLNA. Prerequisites ================== - libexif - libjpeg - libid3tag - libFLAC - libvorbis - libsqlite3 - libavformat (the ffmpeg libraries) Justin Maggard
Description
Languages
C
96.4%
M4
2.2%
Roff
0.8%
Shell
0.3%
Makefile
0.3%