PT-2021-21280 · Signalwire+1 · Freeswitch+1

Xiaobaozidi · Published 2021-04-13 · Updated 2023-10-08 · CVE-2021-36513

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SignalWire freeswitch versions prior to 1.10.6

Description An issue was discovered in the function sofia handle sip i notify in sofia.c, which may allow attackers to view sensitive information due to an uninitialized value.

Recommendations For versions prior to 1.10.6, update to version 1.10.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the sofia handle sip i notify function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-909

Related Identifiers

ALT-PU-2021-1643

ALT-PU-2021-1703

ALT-PU-2021-3374

ALT-PU-2021-3448

ALT-PU-2023-5726

CVE-2021-36513

Affected Products

Alt Linux

Freeswitch

References · 6

• 🔥 https://github.com/signalwire/freeswitch/issues/1245 · Exploit
• https://osv.dev/vulnerability/CVE-2021-36513 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36513 · Security Note
• https://github.com/signalwire/freeswitch/releases/tag/v1.10.6 · Note
• https://t.me/cibsecurity/30722 · Telegram Post
• https://newreleases.io/project/github/signalwire/freeswitch/release/v1.10.6 · Note