CVE-2021-46837 Null dereference in n/a
An attacker can crash the Asterisk PBX by sending a malformed T.38 re-invite response, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-46837?
CVE-2021-46837 is a medium-severity vulnerability in Debian Debian Linux, published on 30 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This is a re-occurrence of the CVE-2019-15297 symptoms but not for exactly the same reason. The crash occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.
Weakness: CWE-476
Which versions are affected by CVE-2021-46837?
It affects 3 products.
Products include Asterisk Certified Asterisk, Debian Debian Linux, Digium Asterisk.
How do I fix CVE-2021-46837?
Upgrade to a fixed version.
Is CVE-2021-46837 being exploited?
There is no known exploitation of CVE-2021-46837 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2021-46837, GHSA-544v-7w28-m77x, UBUNTU-CVE-2021-46837.