A ring security update has been released for Debian GNU/Linux 9 LTS to address an issue where an attacker is able to crash the server resulting in a denial of service.

DLA 2665-1: ring security update

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2665-1 debian-lts@lists.debian.org
  https://www.debian.org/lts/security/ Thorsten Alteholz
May 23, 2021   https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : ring
Version : 20161221.2.7bd7d91~dfsg1-1+deb9u1
CVE ID : CVE-2021-21375

An issue has been found in ring, a secure and distributed voice, video and
chat platform. Actually the embedded copy of pjproject is affected by this
CVE.
Due to bad handling of two consecutive crafted answers to an INVITE, the
attacker is able to crash the server resulting in a denial of service.

For Debian 9 stretch, this problem has been fixed in version
20161221.2.7bd7d91~dfsg1-1+deb9u1.

We recommend that you upgrade your ring packages.

For the detailed security status of ring please refer to
its security tracker page at:
  https://security-tracker.debian.org/tracker/ring

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at:   https://wiki.debian.org/LTS