CVE-2014-4045 — Reachable Assertion in Asterisk

CWE-1893 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
1.8%
top 17.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Digium AsteriskDebian Asterisk
Timeline
PublishedJun 17
Latest updateMay 14

Description

The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub_min_expiry is set to zero, allows remote attackers to cause a denial of service (assertion failure and crash) via an unsubscribe request when not subscribed to the device.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶NVDdigium/asterisk5 versions+4

Patches

Patch: downloads.asterisk.org ↗Patch: downloads.asterisk.org ↗

🔴Vulnerability Details

1
GHSA
GHSA-p9mr-2cw8-4xhj: The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12↗2022-05-14
▶

📋Vendor Advisories

1
Debian
CVE-2014-4045: asterisk - The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Sou...↗2014
▶