Vulnerability Intelligence Report
CVE-2017-9372
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
No Active Exploit Signals
CVSS Base Score
7.5
HIGH
EPSS Probability:3.99%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| digium | open_source | 13.0.0, 13.1.0, 13.2.0, 13.3.0, 13.4.0, 13.5.0, 13.6.0, 13.7.0, 13.8.0, 13.8.1, 13.8.2, 13.9.0, 13.10.0, 13.11.0, 13.12.0, 13.12.1, 13.12.2, 13.13.0, 13.14.0, 13.15.0, 14.0.0, 14.1.0, 14.2.0, 14.2.1, 14.3.0, 14.4.0 |
| digium | certified_asterisk | 13.13.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
3.989%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2017-06-02T00:00:00 |
| Published | 2017-06-02T14:00:00 |
| Patch Date | 2017-06-02 |
| Last Updated | 2024-08-05T17:02:44 |
Community Chatter & Buzz