PT-2020-16952 · Sangoma+1 · Asterisk+1

Ruslan Lazin + 1 · Published 2020-11-06 · Updated 2025-02-13 · CVE-2020-28242

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 13.x through 13.37.0 Asterisk Open Source versions 16.x through 16.14.0 Asterisk Open Source versions 17.x through 17.8.0 Asterisk Open Source versions 18.x through 18.0.0 Certified Asterisk versions prior to 16.8-cert5

Description An issue was discovered where Asterisk, when challenged on an outbound INVITE and the nonce is changed in each response, will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate, ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur.

Recommendations For Asterisk Open Source versions 13.x through 13.37.0, update to version 13.37.1 or later. For Asterisk Open Source versions 16.x through 16.14.0, update to version 16.14.1 or later. For Asterisk Open Source versions 17.x through 17.8.0, update to version 17.8.1 or later. For Asterisk Open Source versions 18.x through 18.0.0, update to version 18.0.1 or later. For Certified Asterisk versions prior to 16.8-cert5, update to version 16.8-cert5 or later.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALT-PU-2023-6874

ALT-PU-2025-2613

CVE-2020-28242

DLA-2969-1

Affected Products

Alt Linux

Asterisk

References · 15

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUS54QTQCYKR36EIULYD544GXDA644HB · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-28242 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-28242 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-28242 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2969-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-28242 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28242 · Security Note
• http://downloads.asterisk.org/pub/security/AST-2020-002.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28242 · Vendor Advisory
• https://t.me/cvenotify/28357 · Telegram Post
• https://t.me/cvenotify/5234 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html · Note
• https://t.me/cvenotify/90706 · Telegram Post
• https://t.me/cvenotify/6282 · Telegram Post