1 Dec
2021
1 Dec
'21
11:13 p.m.
Anyone knows about this?
https://nvd.nist.gov/vuln/detail/CVE-2020-28361
--
Regards,
David Villasmil
email: david.villasmil.work(a)gmail.com
phone: +34669448337
1 Dec
1 Dec
11:30 p.m.
Hi David,
I believe it was originally found by Enable Security;
https://www.rtcsec.com/article/smuggling-sip-headers-past-sbc/
<https://www.rtcsec.com/article/smuggling-sip-headers-past-sbc/>
Although happy to be corrected if they were not the original reporters.
Dan
On 1 Dec 2021, at 22:13, David Villasmil
<david.villasmil.work(a)gmail.com> wrote:
Anyone knows about this?
https://nvd.nist.gov/vuln/detail/CVE-2020-28361
<https://nvd.nist.gov/vuln/detail/CVE-2020-28361>--
Regards,
David Villasmil
email: david.villasmil.work(a)gmail.com <mailto:david.villasmil.work@gmail.com>
phone: +34669448337
__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
* sr-users(a)lists.kamailio.org
Important: keep the mailing list in the recipients, do not reply only to the sender!
Edit mailing list options or unsubscribe:
* https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
11:45 p.m.
Linked from that CVE to
https://packetstormsecurity.com/files/159030/Kamailio-5.4.0-Header-Smugglin… it's
marked as fixed in 5.4.0. The change log from 5.3.6 also looks like it contains the
fixes
https://www.kamailio.org/pub/kamailio/5.3.6/ChangeLog:
commit 340deabc375272dc3f0a921786890dab8ee778b3
Author: Daniel-Constantin Mierla miconda@gmail.com<mailto:miconda@gmail.com>
Date: Thu Jul 16 09:16:40 2020 +0200
core: strutils - trim trailing spaces when comparing hdr names
(cherry picked from commit 6d76b79b81bf448fa1f34753c1d000dc6c1870e0)
(cherry picked from commit d0f7c7056b32351cac0b20ce24b074d9be8459a2)
commit 434dfd38aad2a0e9115ceba55d871fba5d6628f2
Author: Daniel-Constantin Mierla miconda@gmail.com<mailto:miconda@gmail.com>
Date: Thu Jul 16 09:09:48 2020 +0200
core: parser - trim trailing whitespaces in header name
(cherry picked from commit 7135feee9cdc93efa8c0c3e4abf24a9335ce42de)
(cherry picked from commit 63e227383d9c5112f287299981d217f1558a15a8)
Ben Kaufman
From: sr-users <sr-users-bounces(a)lists.kamailio.org> On Behalf Of David Villasmil
Sent: Wednesday, December 1, 2021 4:13 PM
To: Kamailio (SER) - Users Mailing List <sr-users(a)lists.kamailio.org>
Subject: [SR-Users] NIST advisory
Anyone knows about this?
https://nvd.nist.gov/vuln/detail/CVE-2020-28361<https://nam11.safelinks.…
--
Regards,
David Villasmil
email: david.villasmil.work@gmail.com<mailto:david.villasmil.work@gmail.com>
phone: +34669448337
2 Dec
2 Dec
10:14 a.m.
Hi David,
there has been a very interesting discussion here about this
https://lists.kamailio.org/pipermail/sr-users/2020-September/110325.html
Unfortunately there is no dedicated security page on kamailio.org or the wiki therefore
Google indexes Kamailio security issues badly.
Best
Gerry
On 1 Dec 2021, at 23:13, David Villasmil
<david.villasmil.work(a)gmail.com> wrote:
Anyone knows about this?
https://nvd.nist.gov/vuln/detail/CVE-2020-28361
<https://nvd.nist.gov/vuln/detail/CVE-2020-28361>--
Regards,
David Villasmil
email: david.villasmil.work(a)gmail.com <mailto:david.villasmil.work@gmail.com>
phone: +34669448337
__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
* sr-users(a)lists.kamailio.org
Important: keep the mailing list in the recipients, do not reply only to the sender!
Edit mailing list options or unsubscribe:
* https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
10:21 a.m.
Hi David,
and for "unpatched" systems you can use remove_hf_re instead of remove_hf
to avoid that.
Am Do., 2. Dez. 2021 um 10:17 Uhr schrieb Gerry | Rigatta <
gjacobsen(a)rigatta.com>gt;:
Hi David,
there has been a very interesting discussion here about this
https://lists.kamailio.org/pipermail/sr-users/2020-September/110325.html
Unfortunately there is no dedicated security page on kamailio.org or the
wiki therefore Google indexes Kamailio security issues badly.
Best
Gerry
On 1 Dec 2021, at 23:13, David Villasmil <david.villasmil.work(a)gmail.com>
wrote:
Anyone knows about this?
https://nvd.nist.gov/vuln/detail/CVE-2020-28361
--
Regards,
David Villasmil
email: david.villasmil.work(a)gmail.com
phone: +34669448337
__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
* sr-users(a)lists.kamailio.org
Important: keep the mailing list in the recipients, do not reply only to
the sender!
Edit mailing list options or unsubscribe:
* https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
* sr-users(a)lists.kamailio.org
Important: keep the mailing list in the recipients, do not reply only to
the sender!
Edit mailing list options or unsubscribe:
* https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
--
Mit freundlichen Grüßen
*Karsten Horsmann*
883
days inactive
884
days old
4 comments
5 participants
participants (5)
-
Ben Kaufman -
danq＠dial9.co.uk -
David Villasmil -
Gerry | Rigatta -
Karsten Horsmann