CVE-2021-46837 - CVE House

Back to Database

Status published Medium CVE-2021-46837

res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3,...

6.5 CVSS

Vulnerability Description

res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This is a re-occurrence of the CVE-2019-15297 symptoms but not for exactly the same reason. The crash occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-46837

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from asterisk

View All →

Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request

Asterisk remotely exploitable leak of RTP UDP ports and internal resources

Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation

cli_permissions.conf: deny option does not work for disallowing shell commands

Using malformed From header can forge identity with ";" or NULL in name portion

Affected Vendor

asterisk

View all reports →

Affected Software

certified asterisk, asterisk, debian linux

Vulnerable Versions:

16.8.0, 16.0.0, 17.0.0, 18.0.0, 9.0, 10.0, 11.0

Timeline

Official Publish: August 30th, 2022

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.