CVE-2019-18976

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-22 · updated 2026-06-17
Weakness: CWE-476

Description

An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.

Affected products

Debian Linux: 9.0
Digium Asterisk: from 13.0.0 through 13.29.1
Digium Certified Asterisk: 13.21, 13.21-cert1, 13.21-cert2, 13.21-cert3, 13.21-cert4

References

http://downloads.asterisk.org/pub/security/AST-2019-008.html
https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
https://packetstormsecurity.com/files/155436/Asterisk-Project-Security-Advisory-AST-2019-008.html
https://seclists.org/fulldisclosure/2019/Nov/20
https://www.asterisk.org/downloads/security-advisories
https://www.cybersecurity-help.cz/vdb/SB2019112218?affChecked=1
http://downloads.asterisk.org/pub/security/AST-2019-008.html
https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
https://packetstormsecurity.com/files/155436/Asterisk-Project-Security-Advisory-AST-2019-008.html
https://seclists.org/fulldisclosure/2019/Nov/20
https://www.asterisk.org/downloads/security-advisories
https://www.cybersecurity-help.cz/vdb/SB2019112218?affChecked=1

Get alerted when CVE-2019-18976 or the next vulnerability affects your stack