CVEvulnerability

CVE-2020-28242

6.5 MEDIUM Published 2020-11-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-11-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:N/A:P
Weaknesses
CWE-674

Description

An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur.

Affected configurations

• asterisk certified asterisk (<= 16.8.0) • sangoma asterisk (>= 13.0 < 13.37.1) • sangoma asterisk (>= 16.0 < 16.14.1) • sangoma asterisk (>= 17.0 < 17.8.1) • sangoma asterisk (>= 18.0 < 18.0.1) • fedoraproject fedora 33 • debian debian linux 9.0

Related

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References