[asterisk-bugs] [JIRA] (ASTERISK-24711) DTLS handshake broken with latest OpenSSL versions

[Matt Jordan (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-24711?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Matt Jordan updated ASTERISK-24711:
-----------------------------------

    Target Release Version/s: 13.2.0

> DTLS handshake broken with latest OpenSSL versions
> --------------------------------------------------
>
>                 Key: ASTERISK-24711
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-24711
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>    Affects Versions: 13.1.0
>            Reporter: Jared Biel
>            Assignee: Joshua Colp
>      Target Release: 11.16.0, 13.2.0
>
>
> The latest versions of OpenSSL recently cleaned up some DTLS vulnerabilities and one of them (I believe it's CVE-2015-0206) caused RTP DTLS handshakes to stop working. This means that all WebRTC calls fail to negotiate audio. I came across this issue using a fully updated Ubuntu 14.04 server running OpenSSL 1.0.1f-1ubuntu2.8 and Asterisk 13.1.0.
> Upstream report: http://rt.openssl.org/Ticket/Display.html?id=3657
> The one-line workaround mentioned in the ticket worked for me. Patch:
> \[mjordan\]: Code redacted.
> *NOTE*:
> Unfortunately, we cannot accept even one-line patches in comment. If you'd like to contribute this patch to Asterisk, please sign a license contributor agreement and attach the patch in unified diff format.



--
This message was sent by Atlassian JIRA
(v6.2#6252)