CVE-2024-42491: Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of…

PriorityP429medium5.7CVSS 3.1

AVNACLPRLUIRSUCNINAH

EPSS

0.55%

42.0th percentile

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with `.1` or `[.1]`, and res_resolver_unbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable res_resolver_unbound by setting `noload = res_resolver_unbound.so` in modules.conf, or set `rewrite_contact = yes` on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
asterisk	asterisk	< 18.24.3	18.24.3
asterisk	asterisk	< 18.9-cert12	18.9-cert12
asterisk	asterisk	—	—
asterisk	asterisk	—	—
asterisk	asterisk	—	—
asterisk	asterisk	>= 0 < 1:16.28.0~dfsg-0+deb11u5	1:16.28.0~dfsg-0+deb11u5
debian	asterisk	< asterisk 1:16.28.0~dfsg-0+deb11u5 (bullseye)	asterisk 1:16.28.0~dfsg-0+deb11u5 (bullseye)
sangoma	asterisk	< 18.24.3	18.24.3
sangoma	asterisk	>= 20.0.0 < 20.9.3	20.9.3
sangoma	asterisk	21.0.0 – 21.4.3	—
sangoma	certified_asterisk	< 18.9	18.9
sangoma	certified_asterisk	—	—
sangoma	certified_asterisk	—	—

CVSS provenance

nvdv3.15.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

osv5.7MEDIUM

vendor_debian5.7MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.