CVE-2021-46837

    Dashboard / Vulnerabilities / CVE-2021-46837

    CVE-2021-46837

    Published: 30 Aug 2022Last Modified: 24 Oct 2026

    Summary:

    Details: res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This is a re-occurrence of the CVE-2019-15297 symptoms but not for exactly the same reason. The crash occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.

    References: https://downloads.asterisk.org/pub/security/AST-2021-006.html, https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html, https://www.debian.org/security/2022/dsa-5285

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a65908f83e2f17a3aca7eb39c8e06045aca02674
    Fixed -e483670754ae41e94c571fb497004779c8c81fb2

    Affected versions

    16.8.0-NA
    16.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-46837 | CVE-DB