CVE-2021-32558

HIGH

Published Jul 30, 20214y ago · Modified Jun 17, 20262w ago

7.5 CVSS 3.1

High

Published Jul 30, 2021 4y ago

Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-74

Affected Products 23

Vendor	Product	Version	Range
digium	asterisk	*	≥13.0.0 – <13.38.3
digium	asterisk	*	≥16.0.0 – <16.19.1
digium	asterisk	*	≥17.0.0 – <17.9.4
digium	asterisk	*	≥18.0.0 – <18.15.1
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
digium	certified_asterisk	16.8	any
debian	debian_linux	9.0	any
debian	debian_linux	11.0	any

References 6

packetstormsecurity.com http://packetstormsecurity.com/files/163639/Asterisk-Project-Security-Advisory-AST-2021-008.html

PatchThird Party AdvisoryVDB Entry
seclists.org http://seclists.org/fulldisclosure/2021/Jul/49

Mailing ListPatchThird Party Advisory
downloads.asterisk.org https://downloads.asterisk.org/pub/security/AST-2021-008.html

PatchVendor Advisory
issues.asterisk.org https://issues.asterisk.org/jira/browse/ASTERISK-29392

ExploitIssue TrackingPatchVendor Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2021/08/msg00005.html

Mailing ListThird Party Advisory
debian.org https://www.debian.org/security/2021/dsa-4999

Third Party Advisory

Remediation

packetstormsecurity.com http://packetstormsecurity.com/files/163639/Asterisk-Project-Security-Advisory-AST-2021-008.html

PatchThird Party AdvisoryVDB Entry
seclists.org http://seclists.org/fulldisclosure/2021/Jul/49

Mailing ListPatchThird Party Advisory
downloads.asterisk.org https://downloads.asterisk.org/pub/security/AST-2021-008.html

PatchVendor Advisory
issues.asterisk.org https://issues.asterisk.org/jira/browse/ASTERISK-29392

ExploitIssue TrackingPatchVendor Advisory