CVE-2019-13161

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-12 · updated 2026-06-17
Weakness: CWE-476

Description

An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).

Affected products

Debian Linux: 8.0, 9.0
Digium Asterisk: from 13.0.0 before 13.27.1; from 15.0.0 before 15.7.3; from 16.0.0 before 16.4.1 — fixed in 13.27.1, 15.7.3, 16.4.1
Digium Certified Asterisk: 1.8.0.0, 1.8.0.0-beta1, 1.8.0.0-beta2, 1.8.0.0-beta3, 1.8.0.0-beta4, 1.8.0.0-beta5 (+191)

How to fix

Upgrade to a fixed version: Digium Asterisk 13.27.1, 15.7.3, 16.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-13161 or the next vulnerability affects your stack