CVE-2024-42491

Опубликовано: 05 сент. 2024

Источник: nvd

CVSS3: 5.7

EPSS Низкий

Описание

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with .1 or [.1], and res_resolver_unbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable res_resolver_unbound by setting noload = res_resolver_unbound.so in modules.conf, or set rewrite_contact = yes on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*

Версия до 18.24.3 (исключая)

cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*

Версия от 20.0.0 (включая) до 20.9.3 (исключая)

cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*

Версия от 21.0.0 (включая) до 21.4.3 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*

Версия до 18.9 (исключая)

cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*

cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*

EPSS

Процентиль: 62%

0.0044

Низкий

5.7 Medium

CVSS3

Дефекты

CWE-252

Связанные уязвимости

CVE-2024-42491

CVSS3: 5.7

ubuntu

около 1 года назад

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with `.1` or `[.1]`, and res_resolver_unbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable res_resolver_unbound by setting `noload = res_resolver_unbound.so` in modules.conf, or set `rewrite_contact = yes` on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.

CVE-2024-42491

CVSS3: 5.7

debian

около 1 года назад

Asterisk is an open-source private branch exchange (PBX). Prior to ver ...

BDU:2024-06734

CVSS3: 5.7

fstec

около 1 года назад

Уязвимость систем управления IP-телефонией Asterisk и Certified Asterisk, связанная с ошибками отправки SIP-запроса в URI, позволяющая нарушителю вызвать аварийное завершение работы приложения

ROS-20240918-14

CVSS3: 5.7

redos

12 месяцев назад

Уязвимость asterisk

EPSS

Процентиль: 62%

0.0044

Низкий

5.7 Medium

CVSS3

Дефекты

CWE-252