Your message dated Tue, 19 Dec 2023 17:32:36 +0100
with message-id <170300355607.5338.10750264136065412...@auryn.jones.dk>
and subject line Re: Bug#1036697: asterisk: CVE-2023-27585
has caused the Debian Bug report #1036697,
regarding asterisk: CVE-2023-27585
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1036697: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036697
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: asterisk
X-Debbugs-CC: t...@security.debian.org
Severity: grave
Tags: security
Hi,
The following vulnerability was published for asterisk.
CVE-2023-27585[0]:
| PJSIP is a free and open source multimedia communication library
| written in C. A buffer overflow vulnerability in versions 2.13 and
| prior affects applications that use PJSIP DNS resolver. It doesn't
| affect PJSIP users who do not utilise PJSIP DNS resolver. This
| vulnerability is related to CVE-2022-24793. The difference is that
| this issue is in parsing the query record `parse_query()`, while the
| issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as
| commit `d1c5e4d` in the `master` branch. A workaround is to disable
| DNS resolution in PJSIP config (by setting `nameserver_count` to zero)
| or use an external resolver implementation instead.
https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr
https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4
https://github.com/pjsip/pjproject/commit/d1c5e4da5bae7f220bc30719888bb389c905c0c5
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2023-27585
https://www.cve.org/CVERecord?id=CVE-2023-27585
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Version: 20.4.0~dfsg+~cs6.13.40431414-1
Quoting Faidon Liambotis (2023-08-07 14:51:50)
> Dear maintainer, security team,
>
> (See #1032092 for a similar bug with an almost equivalent response)
>
> The changelog for the asterisk 1:20.4.0~dfsg+~cs6.13.40431414-1 upload
> dated 2023-08-04, currently in unstable, mentions:
> > + fixate component pjproject at upstream release 2.13.1
>
> The sources seem to indeed indicate that the version shipped for
> pjproject (aka PJSIP) is 2.13.1, which seems to have resolved the
> vulnerabilities listed below.
>
> Specifically:
>
> On Wed, May 24, 2023 at 02:51:41PM +0200, Moritz Mühlenhoff wrote:
> > CVE-2023-27585[0]:
> > | PJSIP is a free and open source multimedia communication library
> > | written in C. A buffer overflow vulnerability in versions 2.13 and
> > | prior affects applications that use PJSIP DNS resolver. It doesn't
> > | affect PJSIP users who do not utilise PJSIP DNS resolver. This
> > | vulnerability is related to CVE-2022-24793. The difference is that
> > | this issue is in parsing the query record `parse_query()`, while the
> > | issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as
> > | commit `d1c5e4d` in the `master` branch. A workaround is to disable
> > | DNS resolution in PJSIP config (by setting `nameserver_count` to zero)
> > | or use an external resolver implementation instead.
> >
> > https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr
> > https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4
> > https://github.com/pjsip/pjproject/commit/d1c5e4da5bae7f220bc30719888bb389c905c0c5
>
> Upstream says "Patched versions: 2.13.1" in the first GitHub GHSA URL
> above (for CVE-2023-27585), and "Patched versions: 2.12.1 or later" for
> the second one (for CVE-2022-24793).
I can confirm that since asterisk release 20.4.0~dfsg+~cs6.13.40431414-1
linked with an embedded copy of PJSIP 2.13.1, which according to
upstream should fix this CVE.
Thanks to Moritz Mühlenhoff and the security for tracking and reporting
this, and to Faidon Liambotis for investigating - and sorry for the late
response.
- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones
[x] quote me freely [ ] ask before reusing [ ] keep private
signature.asc
Description: signature
--- End Message ---
