Unchecked Return Value Affecting asterisk package, versions [,18.24.3) [20.0.0,20.9.3) [21.0.0,21.4.3) [,18.9-cert12) [20.7-cert1-rc1,20.7-cert2)
Threat Intelligence
EPSS
0.04% (12th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-ASTERISK-7922477
- published 6 Sep 2024
- disclosed 5 Sep 2024
- credit Unknown
Introduced: 5 Sep 2024
CVE-2024-42491 Open this link in a new tabHow to fix?
Upgrade asterisk to version 18.24.3, 20.9.3, 21.4.3, 18.9-cert12, 20.7-cert2 or higher.
Overview
Affected versions of this package are vulnerable to Unchecked Return Value through the handling of malformed SIP URIs. An attacker can cause a denial of service by sending a specially crafted SIP request that includes a URI with a malformed host portion.
Note:
Versions in the ranges [,18.9-cert12) and [20.7-cert1-rc1,20.7-cert2) fix asterisk-certified.