Sangoma · Asterisk · CVE-2020-28327
**Name of the Vulnerable Software and Affected Versions**
Asterisk Open Source versions 13.x through 13.37.0
Asterisk Open Source versions 16.x through 16.14.0
Asterisk Open Source versions 17.x through 17.8.0
Asterisk Open Source versions 18.x through 18.0.0
Certified Asterisk versions prior to 16.8-cert5
**Description**
A crash in the res pjsip session module was discovered. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced, causing a gap between the creation of the dialog object and its next use. This gap allowed another thread to free the dialog, leading to a crash when the dialog object or its dependent objects were accessed. The crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS) for SIP transport and the remote client is authenticated or Asterisk is configured for anonymous calling.
**Recommendations**
For Asterisk Open Source versions 13.x through 13.37.0, update to version 13.37.1 or later.
For Asterisk Open Source versions 16.x through 16.14.0, update to version 16.14.1 or later.
For Asterisk Open Source versions 17.x through 17.8.0, update to version 17.8.1 or later.
For Asterisk Open Source versions 18.x through 18.0.0, update to version 18.0.1 or later.
For Certified Asterisk versions prior to 16.8-cert5, update to version 16.8-cert5 or later.