Lucene search

[email protected]CVE-2019-18976

HistoryNov 22, 2019 - 5:15 p.m.

CVE-2019-18976

2019-11-2217:15:00

CWE-476

[email protected]

web.nvd.nist.gov

cve-2019-18976

sangoma asterisk

certified asterisk

res_pjsip_t38.c

null pointer dereference

crash

security issue

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.062 Low

EPSS

Percentile

93.5%

JSON

An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.

CPENameOperatorVersion
digium:certified_asteriskdigium certified asteriskeq13.21
digium:asteriskdigium asteriskle13.29.1
debian:debian_linuxdebian debian linuxeq9.0