6.5

CVE-2021-46837

res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This is a re-occurrence of the CVE-2019-15297 symptoms but not for exactly the same reason. The crash occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.

Data is provided by the National Vulnerability Database (NVD)
Asterisk ≫ Certified Asterisk Version16.8.0 Update-
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert1
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert2
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert3
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert4
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert5
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert6
Digium ≫ Asterisk Version >= 16.0.0 < 16.16.2
Digium ≫ Asterisk Version >= 17.0.0 < 17.9.3
Digium ≫ Asterisk Version >= 18.0.0 < 18.2.2
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.05% 0.137
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.