Stay Secure with the Latest Linux Advisories

security advisorybuffer overflowcritical

Debian Bullseye: DSA-5285-1 Critical: Asterisk Buffer Overflow Threat

Multiple security vulnerabilities have been found in Asterisk, an Open Source Private Branch Exchange. Buffer overflows and other programming errors could be exploited for information disclosure or the execution of arbitrary code. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5285-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Markus Koschany November 17, 2022 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : asterisk CVE ID : CVE-2021-37706 CVE-2021-43299 CVE-2021-43300 CVE-2021-43301 CVE-2021-43302 CVE-2021-43303 CVE-2021-43804 CVE-2021-43845 CVE-2021-46837 CVE-2022-21722 CVE-2022-21723 CVE-2022-23608 CVE-2022-24763 CVE-2022-24764 CVE-2022-24786 CVE-2022-24792 CVE-2022-24793 CVE-2022-26498 CVE-2022-26499 CVE-2022-26651 Debian Bug : 1014998 1018073 1014976 Multiple security vulnerabilities have been found in Asterisk, an Open Source Private Branch Exchange. Buffer overflows and other programming errors could be exploited for information disclosure or the execution of arbitrary code. Special care should be taken when upgrading to this new upstream release. Some configuration files and options have changed in order to remedy certain security vulnerabilities. Most notably the pjsip TLS listener only accepts TLSv1.3 connections in the default configuration now. This can be reverted by adding method=tlsv1_2 to the transport in pjsip.conf. See also https://issues-archive.asterisk.org/ASTERISK-29017. For the stable distribution (bullseye), these problems have been fixed in version 1:16.28.0~dfsg-0+deb11u1. We recommend that you upgrade your asterisk packages. For the detailed security status of asterisk please refer to its security tracker pageat: https://security-tracker.debian.org/tracker/source-package/asterisk Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Update Asterisk to address serious security vulnerabilities such as buffer overflow incidents and potential data exposure risks.. Debian Security Advisory,Docker Asterisk,Security Update,Buffer Overflow Fix. . Severity: Critical. LinuxSecurity.com Team

Nov 17, 2022 •Critical Debian