asterisk: CVE-2020-28327

Debian Bug report logs - #974712
asterisk: CVE-2020-28327

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: asterisk: CVE-2020-28327

Date: Sat, 14 Nov 2020 07:27:32 +0100

Source: asterisk
Version: 1:16.12.0~dfsg-1
Severity: important
Tags: security upstream
Forwarded: https://issues.asterisk.org/jira/browse/ASTERISK-29057
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for asterisk.

CVE-2020-28327[0]:
| A res_pjsip_session crash was discovered in Asterisk Open Source 13.x
| before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x
| before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon
| receiving a new SIP Invite, Asterisk did not return the created dialog
| locked or referenced. This caused a gap between the creation of the
| dialog object, and its next use by the thread that created it.
| Depending on some off-nominal circumstances and timing, it was
| possible for another thread to free said dialog in this gap. Asterisk
| could then crash when the dialog object, or any of its dependent
| objects, were dereferenced or accessed next by the initial-creation
| thread. Note, however, that this crash can only occur when using a
| connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP
| transport. Also, the remote client must be authenticated, or Asterisk
| must be configured for anonymous calling.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-28327
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28327
[1] https://issues.asterisk.org/jira/browse/ASTERISK-29057

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.