There are a couple of issues found in the SSL socket:
- A race condition between callback and destroy, due to the accepted socket having no group lock.
- SSL socket parent/listener may get destroyed during handshake.
Impact
Both issues were reported to happen intermittently in heavy load TLS connections on the server. They cause a crash, resulting in a denial of service. Client apps are typically not affected unless they accept incoming TLS connections and anticipate many such connections.
Patches
The patch is available in commit d5f95aa.
For more information
If you have any questions or comments about this advisory:
Email us at contact@pjsip.org
There are a couple of issues found in the SSL socket:
Impact
Both issues were reported to happen intermittently in heavy load TLS connections on the server. They cause a crash, resulting in a denial of service. Client apps are typically not affected unless they accept incoming TLS connections and anticipate many such connections.
Patches
The patch is available in commit d5f95aa.
For more information
If you have any questions or comments about this advisory:
Email us at contact@pjsip.org