CVE-2021-46837

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-30 · updated 2026-06-17
Weakness: CWE-476

Description

res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This is a re-occurrence of the CVE-2019-15297 symptoms but not for exactly the same reason. The crash occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.

Affected products

asterisk Certified Asterisk: 16.8.0, 16.8.0-cert1, 16.8.0-cert2, 16.8.0-cert3, 16.8.0-cert4, 16.8.0-cert5 (+1)
Debian Linux: 9.0, 10.0, 11.0
Digium Asterisk: from 16.0.0 before 16.16.2; from 17.0.0 before 17.9.3; from 18.0.0 before 18.2.2 — fixed in 16.16.2, 17.9.3, 18.2.2

How to fix

Upgrade to a fixed version: Digium Asterisk 16.16.2, 17.9.3, 18.2.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-46837 or the next vulnerability affects your stack