CVE catalog

CVE-2020-15260

ring: CVE-2020-15260

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.99% · Oct 25, 2026

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.10 and earlier, PJSIP transport can be reused if they have the same IP address + port + protocol. However, this is insufficient for secure transport since it lacks remote hostname authentication. Suppose we have created a TLS connection to `sip.foo.com`, which has an IP address `100.1.1.1`. If we want to create a TLS connection to another hostname, say `sip.bar.com`, which has the same IP address, then it will reuse that existing connection, even though `100.1.1.1` does not have certificate to authenticate as `sip.bar.com`. The vulnerability allows for an insecure interaction without user awareness. It affects users who need access to connections to different destinations that translate to the same address, and allows man-in-the-middle attack if attacker can route a connection to another destination such as in the case of DNS spoofing.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianringbookworm20230206.0~ds2-1.1+deb12u1fixed
Debianringbookworm-security20230206.0~ds2-1.1+deb12u1fixed
Alpinepjproject3.142.11-r0fixed
Alpinepjproject3.152.11-r0fixed
Alpinepjproject3.162.11-r0fixed
Alpinepjproject3.172.11-r0fixed
Alpinepjproject3.182.11-r0fixed
Alpinepjproject3.192.11-r0fixed
Alpinepjproject3.202.11-r0fixed
Alpinepjproject3.212.11-r0fixed
Alpinepjproject3.222.11-r0fixed
Alpinepjproject3.232.11-r0fixed
Alpinepjproject3.242.11-r0fixed
Ubuntupjprojectpro2.6~dfsg-2vulnerable
Ubuntupjprojectpro2.7~dfsg-1vulnerable
Ubuntupjprojectpro2.7.1~dfsg-1vulnerable
Ubuntupjprojectpro2.7.1~dfsg-1build1vulnerable
Ubuntupjprojectpro2.7.2~dfsg-1vulnerable
Ubuntupjprojectpro2.7.2~dfsg-1ubuntu0.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianringsourcebookworm20210112.2.b757bac~ds1-1not yet assignedNot reported[986815]
Alpinepjprojectapk3.142.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Alpinepjprojectapk3.152.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Alpinepjprojectapk3.162.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Alpinepjprojectapk3.172.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Alpinepjprojectapk3.182.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Alpinepjprojectapk3.192.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Alpinepjprojectapk3.202.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Alpinepjprojectapk3.212.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Alpinepjprojectapk3.222.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Alpinepjprojectapk3.232.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Alpinepjprojectapk3.242.11-r0Not reportedALPINE-CVE-2020-15260Not reported
Ubuntupjprojectdebpro2.7.2~dfsg-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2020-15260Not reported

[Debian bug #986815]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [jami]Fixed

    Source package: [ring]

    Details (4)

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 20210112.2.b757bac~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 20210112.2.b757bac~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 20210112.2.b757bac~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 20210112.2.b757bac~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

  • [jami-daemon]Fixed

    Source package: [ring]

    Details (4)

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 20210112.2.b757bac~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 20210112.2.b757bac~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 20210112.2.b757bac~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 20210112.2.b757bac~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]