CVE-2021-31878: An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1

Login Request a demo

Medium severity · published Jul 30, 2021

CVE-2021-31878

An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1

6.5

CVSS

2.5%

EPSS

No

On KEV

Description

An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. To exploit, a re-INVITE without SDP must be received after Asterisk has sent a BYE request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.5% · higher than 84% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AS

Asterisk · Digium

16.17.0; 16.18.0; 16.19.0; 18.3.0; 18.4.0; 18.5.0 · source: NVD

Affected product

AS

Asterisk

Digium

All Asterisk CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-31878

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-31878

Patch

http://downloads.asterisk.org/pub/security/AST-2021-007.html

Patch

http://packetstormsecurity.com/files/163638/Asterisk-Project-Security-Advisory-AST-2021-007.html

Mailing List

http://seclists.org/fulldisclosure/2021/Jul/48

Patch

https://downloads.digium.com/pub/security/AST-2021-007.html

Exploit

https://issues.asterisk.org/jira/browse/ASTERISK-29381