PT-2022-12938 · Sangoma+1 · Asterisk+1

Gregory Massel · Published 2022-08-30 · Updated 2025-02-13 · CVE-2021-46837

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Sangoma Asterisk versions 16.x through 16.16.1 Sangoma Asterisk versions 17.x through 17.9.2 Sangoma Asterisk versions 18.x through 18.2.1 Certified Asterisk versions prior to 16.8-cert7

Description The issue allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.

Recommendations For Sangoma Asterisk versions 16.x through 16.16.1, update to version 16.16.2 or later. For Sangoma Asterisk versions 17.x through 17.9.2, update to version 17.9.3 or later. For Sangoma Asterisk versions 18.x through 18.2.1, update to version 18.2.2 or later. For Certified Asterisk versions prior to 16.8-cert7, update to version 16.8-cert7 or later.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2023-6874

ALT-PU-2025-2613

CVE-2021-46837

DLA-3194-1

DSA-5285-1

Affected Products

Alt Linux

Asterisk

References · 15

• https://security-tracker.debian.org/tracker/CVE-2021-46837 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-46837 · Security Note
• https://osv.dev/vulnerability/DLA-3194-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46837 · Security Note
• https://debian.org/security/2022/dsa-5285 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5285-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46837 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46837 · Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2021-006.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46837 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html · Note
• https://t.me/cvenotify/38056 · Telegram Post
• https://t.me/cvenotify/37955 · Telegram Post
• https://t.me/cibsecurity/49035 · Telegram Post