CVE-2023-49786

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-49786
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-49786.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-49786
Aliases
  • GHSA-hxj9-xwr8-w8pq
Downstream
Published
2023-12-14T19:47:46.306Z
Modified
2026-07-07T08:52:43.450733263Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation
Details

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1; as well as certified-asterisk prior to 18.9-cert6; Asterisk is susceptible to a DoS due to a race condition in the hello handshake phase of the DTLS protocol when handling DTLS-SRTP for media setup. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable Asterisk servers for calls that rely on DTLS-SRTP. Commit d7d7764cb07c8a1872804321302ef93bf62cba05 contains a fix, which is part of versions 18.20.1, 20.5.1, 21.0.1, amd 18.9-cert6.

Database specific 
{
    "cwe_ids": [
        "CWE-703"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49786.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type
GIT
Repo
https://github.com/asterisk/asterisk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
14d0e59f3d8f7521621561168ef4a297702d978f
Introduced
de4f63b4824c91a0cd9f3d95f3b7923bec71960c
Fixed
f7a8ac086de697db30e376d589a6f4e17cfabef5
Introduced
12da95e53ff42287ad69d6d5922e06c3d62010ac
Fixed
d7d7764cb07c8a1872804321302ef93bf62cba05
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "18.20.1"
        },
        {
            "introduced": "19.0.0"
        },
        {
            "fixed": "20.5.1"
        },
        {
            "introduced": "21.0.0"
        },
        {
            "last_affected": "21.0.0"
        },
        {
            "introduced": "13.13.0"
        },
        {
            "last_affected": "13.13.0"
        },
        {
            "introduced": "13.13.0-rc1"
        },
        {
            "last_affected": "13.13.0-rc1"
        },
        {
            "introduced": "13.13.0-rc2"
        },
        {
            "last_affected": "13.13.0-rc2"
        },
        {
            "introduced": "16.8.0-NA"
        },
        {
            "last_affected": "16.8.0-NA"
        },
        {
            "introduced": "18.9-cert1"
        },
        {
            "last_affected": "18.9-cert1"
        },
        {
            "introduced": "18.9-cert2"
        },
        {
            "last_affected": "18.9-cert2"
        },
        {
            "introduced": "18.9-cert3"
        },
        {
            "last_affected": "18.9-cert3"
        },
        {
            "introduced": "18.9-cert4"
        },
        {
            "last_affected": "18.9-cert4"
        },
        {
            "introduced": "18.9-cert5"
        },
        {
            "last_affected": "18.9-cert5"
        }
    ],
    "cpe": [
        "cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:digium:asterisk:21.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:13.13.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:16.8.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

13.*
13.13.0
13.13.0-rc1
13.13.0-rc2
16.*
16.8.0-NA
18.*
18.17.0
18.17.0-rc1
18.17.1
18.18.0
18.18.0-rc1
18.18.1
18.19.0
18.19.0-rc1
18.19.0-rc2
18.20.0
18.20.0-rc1
18.9-cert1
18.9-cert2
18.9-cert3
18.9-cert4
18.9-cert5
20.*
20.2.0
20.2.0-rc1
20.2.1
20.3.0
20.3.0-rc1
20.3.1
20.4.0
20.4.0-rc1
20.4.0-rc2
20.5.0
20.5.0-rc1
21.*
21.0.0
= 21.*
= 21.0.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-49786.json"