CVE-2020-35652

An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through...

6.5 MediumFix available

CVE-2020-35652 is a medium vulnerability (CVSS 6.5) in Digium Asterisk, published January 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in asterisk 16.15.1-r0.

An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0. A crash can occur when a SIP message is received with a History-Info header that contains a tel-uri, or when a SIP 181 response is received that contains a tel-uri in the Diversion header.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.88%Up 0.8 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

Record: CVE-2020-35652
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-35652
Updated: 2026-11-02

EUVDEUVD-2020-23318 No score

Record: EUVD-2020-23318
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5jwx-hvg3-jjjv No score

An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through...

Record: GHSA-5jwx-hvg3-jjjv
Updated: 2026-11-02

OSVALPINE-CVE-2020-35652 6.5

Record: ALPINE-CVE-2020-35652
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 6.5

Record: CVE-2020-35652
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-35652 6.5

Record: DEBIAN-CVE-2020-35652
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-35652 6.5

Record: UBUNTU-CVE-2020-35652
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

digium asterisk

Affected packages

Affected packages
Package	Affected	Fixed
`asterisk` Alpine:v3.12	14.0 up to 16.15.1-r0	16.15.1-r0
`asterisk` Alpine:v3.13	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Alpine:v3.14	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Alpine:v3.15	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Alpine:v3.16	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Alpine:v3.17	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Alpine:v3.18	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Alpine:v3.19	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Alpine:v3.20	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Alpine:v3.21	14.0 up to 18.1.1-r0	18.1.1-r0

Show 12 moreShow less

Affected packages
Package	Affected	Fixed
`asterisk` Alpine:v3.22	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Alpine:v3.23	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Alpine:v3.24	14.0 up to 18.1.1-r0	18.1.1-r0
`asterisk` Debian:14	before 1:16.15.1~dfsg-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less 1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3	1:16.15.1~dfsg-1
`asterisk` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1:13.1.0~dfsg-1.1ubuntu31:13.1.0~dfsg-1.1ubuntu41:13.1.0~dfsg-1.1ubuntu4.11:13.1.0~dfsg-1.1ubuntu4.1+esm1	None known
`asterisk` Ubuntu:18.04:LTS	All versions, plus listed versions 1:13.17.2~dfsg-1ubuntu11:13.17.2~dfsg-2ubuntu11:13.18.1~dfsg-1ubuntu11:13.18.3~dfsg-1ubuntu11:13.18.3~dfsg-1ubuntu21:13.18.3~dfsg-1ubuntu31:13.18.3~dfsg-1ubuntu4	None known
`asterisk` Ubuntu:20.04:LTS	All versions, plus listed versions 1:16.2.1~dfsg-2build21:16.2.1~dfsg-2build31:16.2.1~dfsg-2ubuntu1	None known
`asterisk` Ubuntu:22.04:LTS	All versions, plus listed versions 1:16.16.1~dfsg-21:16.16.1~dfsg-41:16.16.1~dfsg-4build11:16.16.1~dfsg+~2.10-11:18.10.0~dfsg+~cs6.10.40431411-2	None known
`asterisk` Ubuntu:24.04:LTS	All versions, plus listed versions 1:20.4.0~dfsg+~cs6.13.40431414-21:20.5.0~dfsg+~cs6.13.40431414-11:20.5.1~dfsg+~cs6.13.40431414-11:20.5.2~dfsg+~cs6.13.40431414-11:20.6.0~dfsg+~cs6.13.40431414-1 Show 4 moreShow less 1:20.6.0~dfsg+~cs6.13.40431414-21:20.6.0~dfsg+~cs6.13.40431414-2build31:20.6.0~dfsg+~cs6.13.40431414-2build41:20.6.0~dfsg+~cs6.13.40431414-2build5	None known
`asterisk` Ubuntu:25.10	All versions, plus listed versions 1:22.2.0~dfsg+~cs6.15.60671435-21:22.3.0~dfsg+~cs6.15.60671435-11:22.4.1~dfsg+~cs6.15.60671435-11:22.4.1~dfsg+~cs6.15.60671435-21:22.5.1~dfsg+~cs6.15.60671435-11:22.5.2~dfsg+~cs6.15.60671435-1	None known
`asterisk` Ubuntu:26.10	All versions, plus listed versions 1:22.5.2~dfsg+~cs6.15.60671435-11:22.10.0+dfsg+~cs6.17.60671434-1ubuntu21:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3	None known
`asterisk` Ubuntu:26.04:LTS	All versions, plus listed versions 1:22.5.2~dfsg+~cs6.15.60671435-1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less

This page doesn't list everything

Left out here: 185 versions. The JSON record has them.