Bug#974712: asterisk: CVE-2020-28327

[Salvatore Bonaccorso]

Source: asterisk
Version: 1:16.12.0~dfsg-1
Severity: important
Tags: security upstream
Forwarded: https://issues.asterisk.org/jira/browse/ASTERISK-29057
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for asterisk.

CVE-2020-28327[0]:
| A res_pjsip_session crash was discovered in Asterisk Open Source 13.x
| before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x
| before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon
| receiving a new SIP Invite, Asterisk did not return the created dialog
| locked or referenced. This caused a gap between the creation of the
| dialog object, and its next use by the thread that created it.
| Depending on some off-nominal circumstances and timing, it was
| possible for another thread to free said dialog in this gap. Asterisk
| could then crash when the dialog object, or any of its dependent
| objects, were dereferenced or accessed next by the initial-creation
| thread. Note, however, that this crash can only occur when using a
| connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP
| transport. Also, the remote client must be authenticated, or Asterisk
| must be configured for anonymous calling.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-28327
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28327
[1] https://issues.asterisk.org/jira/browse/ASTERISK-29057

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore