PT-2020-16974 · Sangoma+1 · Asterisk+1

Sandro Gauci + 1 · Published 2020-11-06 · Updated 2025-02-13 · CVE-2020-28327

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 13.x through 13.37.0 Asterisk Open Source versions 16.x through 16.14.0 Asterisk Open Source versions 17.x through 17.8.0 Asterisk Open Source versions 18.x through 18.0.0 Certified Asterisk versions prior to 16.8-cert5

Description A crash in the res pjsip session module was discovered. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced, causing a gap between the creation of the dialog object and its next use. This gap allowed another thread to free the dialog, leading to a crash when the dialog object or its dependent objects were accessed. The crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS) for SIP transport and the remote client is authenticated or Asterisk is configured for anonymous calling.

Recommendations For Asterisk Open Source versions 13.x through 13.37.0, update to version 13.37.1 or later. For Asterisk Open Source versions 16.x through 16.14.0, update to version 16.14.1 or later. For Asterisk Open Source versions 17.x through 17.8.0, update to version 17.8.1 or later. For Asterisk Open Source versions 18.x through 18.0.0, update to version 18.0.1 or later. For Certified Asterisk versions prior to 16.8-cert5, update to version 16.8-cert5 or later.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALT-PU-2023-6874

ALT-PU-2025-2613

CVE-2020-28327

Affected Products

Alt Linux

Asterisk

References · 15

• 🔥 https://issues.asterisk.org/jira/browse/ASTERISK-29057 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-28327 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-28327 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-28327 · Security Note
• http://downloads.asterisk.org/pub/security/AST-2020-001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28327 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-28327 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28327 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28327 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-28327 · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/11/06/1 · Note
• https://t.me/cvenotify/5470 · Telegram Post
• https://t.me/cvenotify/90707 · Telegram Post
• https://security.alpinelinux.org/vuln/CVE-2020-28327 · Note
• https://t.me/cvenotify/5283 · Telegram Post