Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2021-32558: An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driv...
CVE-2021-32558 · published 5 years ago
Summary
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.
What to do
- Update debian asterisk to version 1:16.16.1~dfsg-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | digium | asterisk |
>= 13.0.0, < 13.38.3 >= 16.0.0, < 16.19.1 >= 17.0.0, < 17.9.4 >= 18.0.0, < 18.15.1 cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:* |
| – | digium | certified_asterisk |
16.8 cpe:2.3:a:digium:certified_asterisk:16.8:-:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 11.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Ubuntu:Pro:16.04:LTS | canonical | asterisk | All versions |
| Debian:14 | debian | asterisk |
< 1:16.16.1~dfsg-2 Fix: upgrade to 1:16.16.1~dfsg-2
|
Original advisory text
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driv...
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.
References
- https://lists.debian.org/debian-lts-announce/2021/08/msg00005.html Vendor Advisory
- https://www.debian.org/security/2021/dsa-4999 Vendor Advisory
- http://packetstormsecurity.com/files/163639/Asterisk-Project-Security-Advisory-A... Patch
- https://ubuntu.com/security/CVE-2021-32558 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-32558 Third Party Advisory
- https://downloads.asterisk.org/pub/security/AST-2021-008.html Third Party Advisory
- http://seclists.org/fulldisclosure/2021/Jul/49 Patch
- https://issues.asterisk.org/jira/browse/ASTERISK-29392 Patch
- https://security-tracker.debian.org/tracker/CVE-2021-32558 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-74Injection
Timeline
Published30 Jul 2021
Updated21 Oct 2026
First seen29 Sep 2026
Sources
CVE-2021-32558 · OSV
CVE-2021-32558 · NVD
UBUNTU-CVE-2021-32558 · OSV
DEBIAN-CVE-2021-32558 · OSV
Track software like this
Free during beta