CVE-2021-32558

Опубликовано: 30 июл. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.

Ссылки

http://packetstormsecurity.com/files/163639/Asterisk-Project-Security-Advisory-AST-2021-008.html
Patch
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2021/Jul/49
Mailing List
Patch
Third Party Advisory
https://downloads.asterisk.org/pub/security/AST-2021-008.html
Patch
Vendor Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-29392
Exploit
Issue Tracking
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/08/msg00005.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2021/dsa-4999
Third Party Advisory
http://packetstormsecurity.com/files/163639/Asterisk-Project-Security-Advisory-AST-2021-008.html
Patch
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2021/Jul/49
Mailing List
Patch
Third Party Advisory
https://downloads.asterisk.org/pub/security/AST-2021-008.html
Patch
Vendor Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-29392
Exploit
Issue Tracking
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/08/msg00005.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2021/dsa-4999
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*

Версия от 13.0.0 (включая) до 13.38.3 (исключая)

cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*

Версия от 16.0.0 (включая) до 16.19.1 (исключая)

cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*

Версия от 17.0.0 (включая) до 17.9.4 (исключая)

cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*

Версия от 18.0.0 (включая) до 18.15.1 (исключая)

cpe:2.3:a:digium:certified_asterisk:16.8:-:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert2:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert3:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert4:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert5:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert6:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert7:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert8:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert9:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

EPSS

Процентиль: 78%

0.01214

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-74

Связанные уязвимости

CVE-2021-32558

CVSS3: 7.5

ubuntu

почти 4 года назад

CVE-2021-32558

CVSS3: 7.5

debian

почти 4 года назад

An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x ...

ROS-20211223-05

redos

больше 3 лет назад

Уязвимость приложения компьютерной телефонии Asterisk

GHSA-xhjf-mf8w-q63p

github

около 3 лет назад

BDU:2021-06391

CVSS3: 7.5

fstec

почти 4 года назад

Уязвимость приложения компьютерной телефонии Asterisk, связанная недостаточной проверкой вводимых данных, позволяющая нарушителю выполнить отказ в обслуживании

EPSS

Процентиль: 78%

0.01214

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-74