Critical Crash Vulnerability in Asterisk Package: CVE-2019-15297
Summary
ALPINE-CVE-2019-15297: res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. Affects asterisk versions < 16.3.0-r2. Fixed in 16.3.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an open-source framework for building communications applications. It is widely used for VoIP (Voice over Internet Protocol) services, enabling users to create custom telephony solutions. The package is known for its flexibility and extensive features, including support for various protocols and codecs. However, it has been identified to have a vulnerability that can lead to service disruption.
Vulnerability Detail
The vulnerability, identified as CVE-2019-15297, affects the res_pjsip_t38 component in Sangoma Asterisk versions 15.x before 15.7.4 and 16.x before 16.5.1. An attacker can exploit this vulnerability by sending a declined stream in response to a T.38 re-invite initiated by Asterisk, leading to a crash due to a NULL session media object dereference. This can result in service outages and potential denial of service, impacting users relying on Asterisk for communication services.
How To Fix
Minimum fixed version
16.3.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling T.38 support in your Asterisk configuration until the package can be updated. This can be done by modifying the configuration files to prevent T.38 re-invites.
Conclusion
CVE-2019-15297 is a significant vulnerability in the Asterisk package that can lead to service crashes. It is crucial for users to update their installations to the patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for asterisk →
FAQ
CVE-2019-15297 is a vulnerability in the Asterisk package that allows an attacker to crash the service by sending a malformed response during a T.38 re-invite.
Asterisk versions 15.x before 15.7.4 and 16.x before 16.5.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2019-15297 is 6.5, indicating a medium severity level.
If immediate updates are not possible, consider disabling T.38 support in your configuration as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
