[asterisk-bugs] [JIRA] (ASTERISK-26762) Email notifications sent to wrong emails

[Don Hunter (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-26762?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=234972#comment-234972 ] 

Don Hunter commented on ASTERISK-26762:
---------------------------------------

Joshua,  thanks for the quick response.

Unclear if the issue is related to the number of extensions.  The v11 system has approx 1500 users with voicemail, where v13 systems have very few extensions and have not had reported encounters of the issue.

The issue does seem to be based on user counts, as the issue is becoming more frequent as more users are being added (and thus more users changing their voicemail passwords).

Would you not deem users getting someone else's private voicemail a security issue.


> Email notifications sent to wrong emails
> ----------------------------------------
>
>                 Key: ASTERISK-26762
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-26762
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Applications/app_voicemail
>    Affects Versions: 11.19.0
>            Reporter: Don Hunter
>            Assignee: Don Hunter
>
> We are having serious (privacy) issues of voicemail messages being sent to the wrong email address.  This is occurring many times a day (based on reports)... but could be occurring more frequently.
> The contents (name, phone, voicemail) are all accurate...
> Even the name of the person is accurate.
> However, the email is for another user, not the one it should be.  
> We have finally tracked down the cause and can duplicate the issue.
> If a voicemail is being triggered for email notification at the same time a user is updating their voicemail password, then emails are going to the wrong address.
> Note that all details in the notification are accurate, but the email address is wrong.. this the notification (and message) are sent to the wrong person (extremely bad).
> We noticed that the voicemail.conf file was updating, yet we were not doing any reloads.
> It took some time but we started watching the times the file changed and reports of the incorrect emails.
> We then clicked as to the issue andcan confirm that saving a voicemail message (with email notification) and changing a voicemail password at the same time duplicates the issue.
> Our voicemail.conf file is currently (size): 255905



--
This message was sent by Atlassian JIRA
(v6.2#6252)