Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-49786 Details

Description

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1; as well as certified-asterisk prior to 18.9-cert6; Asterisk is susceptible to a DoS due to a race condition in the hello handshake phase of the DTLS protocol when handling DTLS-SRTP for media setup. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable Asterisk servers for calls that rely on DTLS-SRTP. Commit d7d7764cb07c8a1872804321302ef93bf62cba05 contains a fix, which is part of versions 18.20.1, 20.5.1, 21.0.1, amd 18.9-cert6.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.9 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://packetstormsecurity.com/files/176251/Asterisk-20.1.0-Denial-Of-Service.html	CVE	ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2023/Dec/24	CVE	ExploitMailing ListThird Party Advisory
https://github.com/asterisk/asterisk/commit/d7d7764cb07c8a1872804321302ef93bf62cba05	CVE	Patch
https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq	CVE	ExploitVendor Advisory
https://github.com/EnableSecurity/advisories/tree/master/ES2023-01-asterisk-dtls-hello-race	CVE	Exploit
https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html	CVE
http://www.openwall.com/lists/oss-security/2023/12/15/7	CVE	ExploitMailing List
http://packetstormsecurity.com/files/176251/Asterisk-20.1.0-Denial-Of-Service.html	[email protected]	ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2023/Dec/24	[email protected]	ExploitMailing ListThird Party Advisory
https://github.com/asterisk/asterisk/commit/d7d7764cb07c8a1872804321302ef93bf62cba05	[email protected]	Patch
https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq	[email protected]	ExploitVendor Advisory
https://github.com/EnableSecurity/advisories/tree/master/ES2023-01-asterisk-dtls-hello-race	[email protected]	Exploit
https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html	[email protected]
http://www.openwall.com/lists/oss-security/2023/12/15/7	[email protected]	ExploitMailing List

see all 14 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-362	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')	[email protected]
CWE-703	Improper Check or Handling of Exceptional Conditions	[email protected]

Affected Products

Product	Versions
digium asterisk	< 18.20.1 >= 19.0.0, < 20.5.1 21.0.0
CPE cpe:2.3:a:digium:asterisk:::::::: cpe:2.3:a:digium:asterisk:21.0.0:::::::* Remediation No remediation found in references.
sangoma certified asterisk	13.13.0 13.13.0 cert1 13.13.0 cert1-rc1 13.13.0 cert1-rc2 13.13.0 cert1-rc3
CPE cpe:2.3:a:sangoma:certified_asterisk:13.13.0:::::::* cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1:::::: cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc1:::::: cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc2:::::: cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc3:::::: cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc4:::::: cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert2:::::: cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert3:::::: cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc1:::::: cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc2:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:-:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert1:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert10:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert11:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert12:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert2:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert3:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert4:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert5:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert6:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert7:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert8:::::: cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert9:::::: cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:::::: cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:::::: cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:::::: cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:::::: cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:::::: Remediation No remediation found in references.

Change History

10 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Dec 29, 2023	CVE Modified	[email protected]
Dec 27, 2023	Initial Analysis	[email protected]
Dec 20, 2023	CVE Modified	[email protected]
Dec 15, 2023	CVE Modified	[email protected]
Dec 15, 2023	CVE Modified	[email protected]
Dec 14, 2023	New CVE Received	[email protected]