CVE-2024-42491: A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with .1 or [.1], and resresolverunbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable resresolverunbound by setting noload = resresolverunbound.so in modules.conf, or set rewritecontact = yes on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42491?
The severity of CVE-2024-42491 is classified as moderate, posing potential risks for Asterisk installations that utilize specific SIP request formats.
How do I fix CVE-2024-42491?
To mitigate CVE-2024-42491, upgrade your Asterisk to versions 18.24.3, 20.9.3, or 21.4.3, or for certified Asterisk, update to versions 18.9-cert12 or 20.7-cert2.
What versions of Asterisk are affected by CVE-2024-42491?
CVE-2024-42491 affects Asterisk versions prior to 18.24.3, 20.9.3, and 21.4.3, as well as certified-asterisk versions before 18.9-cert12 and 20.7-cert2.
What consequence does CVE-2024-42491 pose for users?
CVE-2024-42491 may lead to unexpected behavior when Asterisk processes SIP requests directed at certain URI formats.
Is there a workaround for CVE-2024-42491?
There are no documented workarounds for CVE-2024-42491; updating to a patched version is the recommended solution.