This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-28361 →
DEBIAN-CVE-2020-28361
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal...
Original description
The description as published by the source.
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
kamailio
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1"}]}]
Debian:13
kamailio
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1"}]}]
Debian:14
kamailio
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1"}]}]
References
- advisory security-tracker.debian.org