From 683afd55b2ee36eddb7db528aa1faf4205012772 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Mon, 7 Sep 2026 22:22:50 +1200 Subject: [PATCH] miniupnpd: patch CVE-2026-5720 Details: https://nvd.nist.gov/vuln/detail/cve-2026-5720 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../miniupnpd/files/CVE-2026-5720.patch | 35 +++++++++++++++++++ .../miniupnpd/miniupnpd_2.1.20191006.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-5720.patch diff --git a/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-5720.patch b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-5720.patch new file mode 100644 index 0000000000..902e8321a5 --- /dev/null +++ b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-5720.patch @@ -0,0 +1,35 @@ +From d1c82ab65fd685ceed28a1a0de29510df7c3c959 Mon Sep 17 00:00:00 2001 +From: Thomas Bernard +Date: Mon, 23 Mar 2026 02:37:02 +0100 +Subject: [PATCH] upnphttp.c: fix removal of quotes in ParseHttpHeaders() + +the length of the string including the quotes must be at +least 2 for the string to contain the 2 enclosing quotes ! + +(cherry picked from commit f56bd09b2f2650126b832c5f30a65a09e28167fa) + +CVE: CVE-2026-5720 +Upstream-Status: Backport [https://github.com/miniupnp/miniupnp/commit/f56bd09b2f2650126b832c5f30a65a09e28167fa] + +Signed-off-by: Ankur Tyagi +--- + upnphttp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/upnphttp.c b/upnphttp.c +index fc8ccb6..2d9a2a6 100644 +--- a/upnphttp.c ++++ b/upnphttp.c +@@ -269,9 +269,10 @@ ParseHttpHeaders(struct upnphttp * h) + p++; + while(p[n]>=' ') + n++; +- if((p[0] == '"' && p[n-1] == '"') +- || (p[0] == '\'' && p[n-1] == '\'')) ++ if((n >= 2) && ((p[0] == '"' && p[n-1] == '"') ++ || (p[0] == '\'' && p[n-1] == '\''))) + { ++ /* remove the quotes */ + p++; n -= 2; + } + h->req_soapActionOff = p - h->req_buf; diff --git a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.1.20191006.bb b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.1.20191006.bb index b7ba37f290..0aadfe9cf6 100644 --- a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.1.20191006.bb +++ b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.1.20191006.bb @@ -14,6 +14,7 @@ DEPENDS += "iptables net-tools util-linux libmnl libnetfilter-conntrack openssl" SRC_URI = "http://miniupnp.tuxfamily.org/files/download.php?file=${BP}.tar.gz;downloadfilename=${BP}.tar.gz \ file://miniupnpd.service \ file://0001-Add-OpenEmbedded-cross-compile-case.patch \ + file://CVE-2026-5720.patch \ " SRC_URI[sha256sum] = "218fad7af31f3c22fb4c9db28a55a2a8b5067d41f5b38f52008a057a00d2206d"