Bug#874070: rtpproxy: CVE-2017-14114

[Salvatore Bonaccorso]

Source: rtpproxy
Version: 1.2.1-1.1
Severity: grave
Tags: upstream security

Hi,

the following vulnerability was published for rtpproxy.

CVE-2017-14114[0]:
| RTPproxy through 2.2.alpha.20160822 has a NAT feature that results in
| not properly determining the IP address and port number of the
| legitimate recipient of RTP traffic, which allows remote attackers to
| obtain sensitive information or cause a denial of service
| (communication outage) via crafted RTP packets.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-14114
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14114
[1] https://rtpbleed.com

Regards,
Salvatore