CVE-2019-12827

high-risk

Published 2019-07-12

Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.

Do I need to act?

19.6% chance of exploitation in next 30 days

EPSS score — higher than 80% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (6)

Asterisk

Certified Asterisk

Affected Vendors

Digium

References (4)

Vendor Advisory http://downloads.digium.com/pub/security/AST-2019-002.html

Vendor Advisory https://issues.asterisk.org/jira/browse/ASTERISK-28447

Vendor Advisory http://downloads.digium.com/pub/security/AST-2019-002.html

Vendor Advisory https://issues.asterisk.org/jira/browse/ASTERISK-28447

/ 100

high-risk

Severity 24/34 · High

Exploitability 14/34 · Moderate

Exposure 13/34 · Low