Source: asterisk Version: 1:16.12.0~dfsg-1 Severity: important Tags: security upstream Forwarded: https://issues.asterisk.org/jira/browse/ASTERISK-29057 X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for asterisk. CVE-2020-28327[0]: | A res_pjsip_session crash was discovered in Asterisk Open Source 13.x | before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x | before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon | receiving a new SIP Invite, Asterisk did not return the created dialog | locked or referenced. This caused a gap between the creation of the | dialog object, and its next use by the thread that created it. | Depending on some off-nominal circumstances and timing, it was | possible for another thread to free said dialog in this gap. Asterisk | could then crash when the dialog object, or any of its dependent | objects, were dereferenced or accessed next by the initial-creation | thread. Note, however, that this crash can only occur when using a | connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP | transport. Also, the remote client must be authenticated, or Asterisk | must be configured for anonymous calling. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2020-28327 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28327 [1] https://issues.asterisk.org/jira/browse/ASTERISK-29057 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
