Dear maintainer, security team,
(See #1032092 for a similar bug with an almost equivalent response)
The changelog for the asterisk 1:20.4.0~dfsg+~cs6.13.40431414-1 upload
dated 2023-08-04, currently in unstable, mentions:
>+ fixate component pjproject at upstream release 2.13.1
The sources seem to indeed indicate that the version shipped for
pjproject (aka PJSIP) is 2.13.1, which seems to have resolved the
vulnerabilities listed below.
Specifically:
On Wed, May 24, 2023 at 02:51:41PM +0200, Moritz Mühlenhoff wrote:
> CVE-2023-27585[0]:
> | PJSIP is a free and open source multimedia communication library
> | written in C. A buffer overflow vulnerability in versions 2.13 and
> | prior affects applications that use PJSIP DNS resolver. It doesn't
> | affect PJSIP users who do not utilise PJSIP DNS resolver. This
> | vulnerability is related to CVE-2022-24793. The difference is that
> | this issue is in parsing the query record `parse_query()`, while the
> | issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as
> | commit `d1c5e4d` in the `master` branch. A workaround is to disable
> | DNS resolution in PJSIP config (by setting `nameserver_count` to zero)
> | or use an external resolver implementation instead.
>
> https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr
> https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4
> https://github.com/pjsip/pjproject/commit/d1c5e4da5bae7f220bc30719888bb389c905c0c5
Upstream says "Patched versions: 2.13.1" in the first GitHub GHSA URL
above (for CVE-2023-27585), and "Patched versions: 2.12.1 or later" for
the second one (for CVE-2022-24793).
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
>
> [...]
>
> Please adjust the affected versions in the BTS as needed.
As I'm neither the maintainer nor in the security team, I'm leaving
these actions to you. Hopefully simple enough, once you confirm my
findings :)
Regards,
Faidon
