Every CVE Search/ Get API key

CVE-2019-15297

res_pjsip_t38 in Sangoma Asterisk 13.21-cert4, 15.7.3, and 16.5.0 allows an attacker to trigger a...

6.5 MediumFix available

CVE-2019-15297 is a medium vulnerability (CVSS 6.5) in Digium Asterisk, published September 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.39%, the 88th percentile. Fixed in asterisk 16.3.0-r2.

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.39%Up 2.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

Record
CVE-2019-15297
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

Record
CVE-2019-15297
Updated
2026-11-02
EUVDEUVD-2019-6304 No score

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

Record
EUVD-2019-6304
Updated
2026-11-03
GitHub AdvisoriesGHSA-qc2g-m5w4-ffmq 6.5

res_pjsip_t38 in Sangoma Asterisk 13.21-cert4, 15.7.3, and 16.5.0 allows an attacker to trigger a...

res_pjsip_t38 in Sangoma Asterisk 13.21-cert4, 15.7.3, and 16.5.0 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk.

Record
GHSA-qc2g-m5w4-ffmq
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2019-15297 6.5

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

Record
ALPINE-CVE-2019-15297
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.5

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

Record
CVE-2019-15297
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-15297 6.5

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

Record
DEBIAN-CVE-2019-15297
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-15297 6.5

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

Record
UBUNTU-CVE-2019-15297
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
asterisk
Alpine:v3.10
 15.0.0 up to 16.3.0-r2
16.3.0-r2
asterisk
Alpine:v3.11
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.12
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.13
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.14
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.15
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.16
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.17
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.18
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.19
 15.0.0 up to 16.5.1-r0
16.5.1-r0
Show 12 moreShow less
Affected packages
PackageAffectedFixed
asterisk
Alpine:v3.20
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.21
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.22
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.23
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.24
 15.0.0 up to 16.5.1-r0
16.5.1-r0
asterisk
Alpine:v3.7
 15.0.0 up to 15.6.2-r0
15.6.2-r0
asterisk
Alpine:v3.8
 15.0.0 up to 15.6.2-r0
15.6.2-r0
asterisk
Alpine:v3.9
 15.0.0 up to 15.7.4-r0
15.7.4-r0
asterisk
Debian:14
 before 1:16.10.0~dfsg-1, plus listed versions
0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1
Show 45 moreShow less
1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3
1:16.10.0~dfsg-1
asterisk
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:13.1.0~dfsg-1.1ubuntu31:13.1.0~dfsg-1.1ubuntu41:13.1.0~dfsg-1.1ubuntu4.11:13.1.0~dfsg-1.1ubuntu4.1+esm1
 None known
asterisk
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:13.17.2~dfsg-1ubuntu11:13.17.2~dfsg-2ubuntu11:13.18.1~dfsg-1ubuntu11:13.18.3~dfsg-1ubuntu11:13.18.3~dfsg-1ubuntu21:13.18.3~dfsg-1ubuntu31:13.18.3~dfsg-1ubuntu4
 None known
asterisk
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:16.2.1~dfsg-2build21:16.2.1~dfsg-2build31:16.2.1~dfsg-2ubuntu1
 None known

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 182 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open