CVE-2024-42491

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-42491
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42491.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-42491
Aliases
  • GHSA-v428-g3cw-7hv9
Downstream
Published
2024-09-05T17:17:56.961Z
Modified
2026-07-15T02:12:16.217717118Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used
Details

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with .1 or [.1], and resresolverunbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable resresolverunbound by setting noload = res_resolver_unbound.so in modules.conf, or set rewrite_contact = yes on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42491.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-252",
        "CWE-476"
    ]
}
References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type
GIT
Repo
https://github.com/asterisk/asterisk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f8dddb0e3d8baa3e0649f0e878305f3f810016ac
Fixed
85601849c646709836f59007d04ca829ef0d5955
Introduced
c6c7103efa6605a6db7ca28b4b17cd2d1c15a05c
Fixed
c5e30b7e157b67ec6dba64d3b1a3a3cac907e524
Introduced
12da95e53ff42287ad69d6d5922e06c3d62010ac
Last affected
489a05f269e005242027ab47d37fb6b6a1651989
Introduced
85601849c646709836f59007d04ca829ef0d5955
Fixed
42a2f4ccfa2c7062a15063e765916b3332e34cc4
Fixed
4f01669c7c41c9184f3cce9a3cf1b2ebf6201742
Fixed
50bf8d4d3064930d28ecf1ce3397b14574d514d2
Fixed
7a0090325bfa9d778a39ae5f7d0a98109e4651c8
Fixed
a15050650abf09c10a3c135fab148220cd41d3a0
Database specific 
{
    "cpe": [
        "cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "18.24.3"
        },
        {
            "fixed": "18.9"
        },
        {
            "introduced": "20.0.0"
        },
        {
            "fixed": "20.9.3"
        },
        {
            "introduced": "21.0.0"
        },
        {
            "last_affected": "21.4.3"
        },
        {
            "introduced": "18.9-NA"
        },
        {
            "last_affected": "18.9-NA"
        },
        {
            "introduced": "18.9-cert1"
        },
        {
            "last_affected": "18.9-cert1"
        },
        {
            "introduced": "18.9-cert1\\-rc1"
        },
        {
            "last_affected": "18.9-cert1\\-rc1"
        },
        {
            "introduced": "18.9-cert10"
        },
        {
            "last_affected": "18.9-cert10"
        },
        {
            "introduced": "18.9-cert11"
        },
        {
            "last_affected": "18.9-cert11"
        },
        {
            "introduced": "18.9-cert2"
        },
        {
            "last_affected": "18.9-cert2"
        },
        {
            "introduced": "18.9-cert3"
        },
        {
            "last_affected": "18.9-cert3"
        },
        {
            "introduced": "18.9-cert4"
        },
        {
            "last_affected": "18.9-cert4"
        },
        {
            "introduced": "18.9-cert5"
        },
        {
            "last_affected": "18.9-cert5"
        },
        {
            "introduced": "18.9-cert6"
        },
        {
            "last_affected": "18.9-cert6"
        },
        {
            "introduced": "18.9-cert7"
        },
        {
            "last_affected": "18.9-cert7"
        },
        {
            "introduced": "18.9-cert8"
        },
        {
            "last_affected": "18.9-cert8"
        },
        {
            "introduced": "18.9-cert8\\-rc1"
        },
        {
            "last_affected": "18.9-cert8\\-rc1"
        },
        {
            "introduced": "18.9-cert8\\-rc2"
        },
        {
            "last_affected": "18.9-cert8\\-rc2"
        },
        {
            "introduced": "18.9-cert9"
        },
        {
            "last_affected": "18.9-cert9"
        },
        {
            "introduced": "20.7-cert1"
        },
        {
            "last_affected": "20.7-cert1"
        },
        {
            "introduced": "20.7-cert1\\-rc1"
        },
        {
            "last_affected": "20.7-cert1\\-rc1"
        },
        {
            "introduced": "20.7-cert1\\-rc2"
        },
        {
            "last_affected": "20.7-cert1\\-rc2"
        },
        {
            "introduced": "20.7-cert2"
        },
        {
            "last_affected": "20.7-cert2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

18.*
18.17.0
18.17.0-rc1
18.17.1
18.18.0
18.18.0-rc1
18.18.1
18.19.0
18.19.0-rc1
18.19.0-rc2
18.20.0
18.20.0-rc1
18.20.1
18.20.2
18.21.0
18.21.0-rc1
18.21.0-rc2
18.22.0
18.22.0-rc1
18.22.0-rc2
18.23.0
18.23.0-rc1
18.23.1
18.24.0
18.24.0-rc1
18.24.1
18.24.2
18.9-NA
18.9-cert1
18.9-cert10
18.9-cert11
18.9-cert1\-rc1
18.9-cert2
18.9-cert3
18.9-cert4
18.9-cert5
18.9-cert6
18.9-cert7
18.9-cert8
18.9-cert8\-rc1
18.9-cert8\-rc2
18.9-cert9
18.9.0
18.9.0-rc1
20.*
20.2.0
20.2.0-rc1
20.2.1
20.3.0
20.3.0-rc1
20.3.1
20.4.0
20.4.0-rc1
20.4.0-rc2
20.5.0
20.5.0-rc1
20.5.1
20.5.2
20.6.0
20.6.0-rc1
20.6.0-rc2
20.7-cert1
20.7-cert1\-rc1
20.7-cert1\-rc2
20.7-cert2
20.7.0
20.7.0-rc1
20.7.0-rc2
20.8.0
20.8.0-rc1
20.8.1
20.9.0
20.9.0-rc1
20.9.1
20.9.2
21.*
21.0.0
21.0.1
21.0.2
21.1.0
21.1.0-rc1
21.1.0-rc2
21.2.0
21.2.0-rc1
21.2.0-rc2
21.3.0
21.3.0-rc1
21.3.1
21.4.0
21.4.0-rc1
21.4.1
21.4.2
21.4.3
certified-18.*
certified-18.9-cert10
certified-18.9-cert4
certified-18.9-cert5
certified-18.9-cert6
certified-18.9-cert7
certified-18.9-cert8
certified-18.9-cert8-rc1
certified-18.9-cert8-rc2
certified-18.9-cert9
certified-20.*
certified-20.7-cert1
certified-20.7-cert1-pre1
certified-20.7-cert1-rc1
certified-20.7-cert1-rc2
certified/18.*
certified/18.9-cert1
certified/18.9-cert1-rc1
certified/18.9-cert2
certified/18.9-cert3
certified/18.9-cert4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42491.json"