Skip to content
OpenAdvisories
High DLA-3925-1 2 CVEs

asterisk - security update

Published Oct 20, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 asterisk 1:16.28.0~dfsg-0+deb11u5

Vulnerabilities 2

  • High 7.4
    CVE-2024-42365 Public exploit

    Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

    Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration …

    asterisk asterisk asterisk asterisk Debian Ubuntu Alpine
  • Medium 5.7
    CVE-2024-42491

    A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used

    Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts wi…

    asterisk asterisk asterisk asterisk Debian Ubuntu Alpine