CVE-2016-9938

An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chansip channel driver has a liberal definition for whitespace when attempting to strip the content betwe...

CVE-2016-9938

CVE-2016-9938 affects Asterisk Open Source chan_sip: improper stripping of non‑printable ASCII whitespace between SIP header name and a colon allows certain To/header combinations to bypass authentication when used with an authenticating SIP proxy. Affected: 11.x < 11.25.1, 13.x < 13.13.1, ...