5.7

CVE-2024-42491

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with `.1` or `[.1]`, and res_resolver_unbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable res_resolver_unbound by setting `noload = res_resolver_unbound.so` in modules.conf, or set `rewrite_contact = yes` on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Sangoma ≫ Asterisk Version < 18.24.3
Sangoma ≫ Asterisk Version >= 20.0.0 < 20.9.3
Sangoma ≫ Asterisk Version >= 21.0.0 <= 21.4.3
Sangoma ≫ Certified Asterisk Version < 18.9
Sangoma ≫ Certified Asterisk Version18.9 Update-
Sangoma ≫ Certified Asterisk Version18.9 Updatecert1
Sangoma ≫ Certified Asterisk Version18.9 Updatecert1-rc1
Sangoma ≫ Certified Asterisk Version18.9 Updatecert10
Sangoma ≫ Certified Asterisk Version18.9 Updatecert11
Sangoma ≫ Certified Asterisk Version18.9 Updatecert2
Sangoma ≫ Certified Asterisk Version18.9 Updatecert3
Sangoma ≫ Certified Asterisk Version18.9 Updatecert4
Sangoma ≫ Certified Asterisk Version18.9 Updatecert5
Sangoma ≫ Certified Asterisk Version18.9 Updatecert6
Sangoma ≫ Certified Asterisk Version18.9 Updatecert7
Sangoma ≫ Certified Asterisk Version18.9 Updatecert8
Sangoma ≫ Certified Asterisk Version18.9 Updatecert8-rc1
Sangoma ≫ Certified Asterisk Version18.9 Updatecert8-rc2
Sangoma ≫ Certified Asterisk Version18.9 Updatecert9
Sangoma ≫ Certified Asterisk Version20.7 Updatecert1
Sangoma ≫ Certified Asterisk Version20.7 Updatecert1-rc1
Sangoma ≫ Certified Asterisk Version20.7 Updatecert1-rc2
Sangoma ≫ Certified Asterisk Version20.7 Updatecert2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.44% 0.623
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
security-advisories@github.com 5.7 2.1 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CWE-252 Unchecked Return Value

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.