CVE-2020-28327

A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced. This caused a gap between the creation of the dialog object, and its next use by the thread that created it. Depending on some off-nominal circumstances and timing, it was possible for another thread to free said dialog in this gap. Asterisk could then crash when the dialog object, or any of its dependent objects, were dereferenced or accessed next by the initial-creation thread. Note, however, that this crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP transport. Also, the remote client must be authenticated, or Asterisk must be configured for anonymous calling.

• CWE-404

• http://downloads.asterisk.org/pub/security/AST-2020-001.htmlPatch, Vendor Advisory
• https://issues.asterisk.org/jira/browse/ASTERISK-29057Exploit, Issue Tracking, Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2020-001.htmlPatch, Vendor Advisory
• https://issues.asterisk.org/jira/browse/ASTERISK-29057Exploit, Issue Tracking, Vendor Advisory

Published

Nov 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28321Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-28322Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-28323Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-28324Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-28325Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-28326Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-28328SuiteCRM before 7.11.17 is vulnerable to remote code executi…8.8
• CVE-2020-28329Barco wePresent WiPG-1600W firmware includes a hardcoded API…9.8
• CVE-2020-2833Vulnerability in the Oracle Quoting product of Oracle E-Busi…8.2
• CVE-2020-28330Barco wePresent WiPG-1600W devices have Unprotected Transpor…6.5
• CVE-2020-28331Barco wePresent WiPG-1600W devices have Improper Access Cont…7.5
• CVE-2020-28332Barco wePresent WiPG-1600W devices download code without an …9.8