CVE-2020-12695 · cross-distro fix matrix

CVE-2020-12695: The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

Affects 8 Linux releases across 19 (distro × package) combinations.

Fix per ecosystem

Each block below is a distro release where CVE-2020-12695 has a known fix. Run the listed command on that distro to remediate.

Source: Debian Security Tracker

gupnp→ fixed in1.2.3-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y gupnp
```
minidlna→ fixed in1.2.1+dfsg-3urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y minidlna
```
wpa→ fixed in2:2.9.0-16urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y wpa
```

Source: Debian Security Tracker

gupnp→ fixed in1.2.3-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y gupnp
```
minidlna→ fixed in1.2.1+dfsg-3urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y minidlna
```
wpa→ fixed in2:2.9.0-16urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y wpa
```

Source: Debian Security Tracker

gupnp→ fixed in1.2.3-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y gupnp
```
minidlna→ fixed in1.2.1+dfsg-3urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y minidlna
```
wpa→ fixed in2:2.9.0-16urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y wpa
```