CVE-2019-12827
UnknownEPSS 4.23%
Last modified
CVE-2019-12827 is a vulnerability of currently unknown severity. Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.. EPSS estimates a 4.23% chance of exploitation in the next 30 days.
Description
Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Digium | Asterisk | >= 13.0.0, < 13.27.0 | — |
| Digium | Asterisk | >= 15.0.0, < 15.7.2 | — |
| Digium | Asterisk | >= 16.0.0, < 16.4.0 | — |
| Digium | Certified Asterisk | 13.21 | Cert1 |
References
- http://downloads.digium.com/pub/security/AST-2019-002.htmlVendor Advisory
- https://issues.asterisk.org/jira/browse/ASTERISK-28447Vendor Advisory
- http://downloads.digium.com/pub/security/AST-2019-002.htmlVendor Advisory
- https://issues.asterisk.org/jira/browse/ASTERISK-28447Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-12827?
Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.
How severe is CVE-2019-12827?
Severity scoring for CVE-2019-12827 is pending analysis. The EPSS model estimates a 4.23% probability of exploitation in the next 30 days.
How do I fix CVE-2019-12827?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-12820A vulnerability was found in the app 2.0 of the Shenzhen Jis…
- CVE-2019-12821A vulnerability was found in the app 2.0 of the Shenzhen Jis…
- CVE-2019-12822In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5…
- CVE-2019-12823Craft CMS before 3.1.31 does not properly filter XML feeds a…6.1
- CVE-2019-12825Unauthorized Access to the Container Registry of other group…4.3
- CVE-2019-12826A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_…
- CVE-2019-12828An issue was discovered in Electronic Arts Origin before 10.…
- CVE-2019-12829radare2 through 3.5.1 mishandles the RParse API, which allow…
- CVE-2019-1283An information disclosure vulnerability exists in the way th…5.5
- CVE-2019-12830In MyBB before 1.8.21, an attacker can exploit a parsing fla…
- CVE-2019-12831In MyBB before 1.8.21, an attacker can abuse a default behav…
- CVE-2019-12834In HT2 Labs Learning Locker 3.15.1, it's possible to inject …7.3
Are you affected by CVE-2019-12827?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST