Description
An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:16.1.1~dfsg-1 | — |
| Debian 9 | asterisk | 1:13.14.1~dfsg-2+deb9u6 | DLA-2969-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | asterisk | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | asterisk | No fix yet | — |
Advisories 1
- DLA-2969-1 asterisk - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://www.asterisk.org/downloads/security-advisories
- https://www.cybersecurity-help.cz/vdb/SB2019112218?affChecked=1
- https://packetstormsecurity.com/files/155436/Asterisk-Project-Security-Advisory-AST-2019-008.html
- https://seclists.org/fulldisclosure/2019/Nov/20
- http://downloads.asterisk.org/pub/security/AST-2019-008.html
- [debian-lts-announce] 20220403 [SECURITY] [DLA 2969-1] asterisk security update mailing-list