Debian alert DLA-2665-1 (ring)

From:
             
 
Thorsten Alteholz <debian@alteholz.de>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 2665-1] ring security update
Date:
             
 
Sun, 23 May 2021 14:37:31 +0000
Message-ID:
             
 
<alpine.DEB.2.21.2105231435040.6153@postfach.intern.alteholz.me>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2665-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                    Thorsten Alteholz
May 23, 2021                                  https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : ring
Version        : 20161221.2.7bd7d91~dfsg1-1+deb9u1
CVE ID         : CVE-2021-21375


An issue has been found in ring, a secure and distributed voice, video and 
chat platform. Actually the embedded copy of pjproject is affected by this 
CVE.
Due to bad handling of two consecutive crafted answers to an INVITE, the 
attacker is able to crash the server resulting in a denial of service.


For Debian 9 stretch, this problem has been fixed in version
20161221.2.7bd7d91~dfsg1-1+deb9u1.

We recommend that you upgrade your ring packages.

For the detailed security status of ring please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ring

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmCqaKtfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEeTfQ//TA/OkWOAXn1K3nBtM7qpsmJhUjPHHRhQF8PTw27cnPgmcoXLKXjdtK8q
i0qmb8DnV2aOmum866X4Po8CzYCZIsVOvlyDEkbyx3dV32oBK8w6i6Ka7Nfp8WeF
TEI2we6iL+Hk83Y2E4sgkfyPYGsLxq+oSQOE9vtphYDbQnUTf3K9WFz4s04/1vB3
vaxJzGQPaWTqa/ukHpKaW3VJAO+n+X2oUpOpbObTLMzKMIF+hYwqKDRYMNGz1Bbp
c/buYBwseQy9DRTg0dvg+9BI02IhtZ64wkiSsYwserwgH0gEm8Kkg4g0oza8PUCx
oeL9P1cw2wj2UpCXm2Ckd5xqbKHhIgcsu75HG5mQVcfQslnH+T44+O8x1uOribLU
fTFDEiDoiFOADSCSDuSYcxwXBNu5pmBQN3EMY+4tPvdphuBLJYYc6bhZceL+aJ4s
lpLHAnW9icFUZH3qAl2t6bldFFbx+6jTTgPaiwx28GJVJHN4Hv3fJPUaGib5/nLL
/b9fYszhKAgdY/cXI7oCOQXkf6emv1NFh33e7vOTSjYDZBuyDNg0jV9WjiXSHhgR
9rQWUsLcztAWRc7lz8E7QOn5YmjGkZ2kQNSU0qD+pmqhybJ+taJD+tbtaTBJhjBG
Bb5MBfrdvfoybL9zxFfYBIwZ5CnLsC9/dxoziwsJwdk6SCpPA58=
=1l+j
-----END PGP SIGNATURE-----