{"id":"CVE-2016-9938","details":"An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chan_sip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable ASCII character as if it were whitespace. This means that headers such as Contact\\x01: will be seen as a valid Contact header. This mostly does not pose a problem until Asterisk is placed in tandem with an authenticating SIP proxy. In such a case, a crafty combination of valid and invalid To headers can cause a proxy to allow an INVITE request into Asterisk without authentication since it believes the request is an in-dialog request. However, because of the bug described above, the request will look like an out-of-dialog request to Asterisk. Asterisk will then process the request as a new call. The result is that Asterisk can process calls from unvetted sources without any authentication. If you do not use a proxy for authentication, then this issue does not affect you. If your proxy is dialog-aware (meaning that the proxy keeps track of what dialogs are currently valid), then this issue does not affect you. If you use chan_pjsip instead of chan_sip, then this issue does not affect you.","modified":"2026-10-24T10:30:20.123304936Z","published":"2016-12-12T21:59:01.617Z","database_specific":{},"references":[{"type":"WEB","url":"http://www.securitytracker.com/id/1037408"},{"type":"ADVISORY","url":"http://downloads.asterisk.org/pub/security/AST-2016-009.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/94789"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asterisk/asterisk","events":[{"introduced":"affbc6907eb544bc6e049085de91002ca24ff930"},{"last_affected":"3f2411a18dd2c71225a706af2fed6e2e719da727"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"11.0.0"},{"last_affected":"11.0.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.0.0:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.0.0:*:*:*:*:*:*:*","range":[{"introduced":"11.0.0"},{"last_affected":"11.0.0"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.0.0-beta1"},{"last_affected":"11.0.0-beta1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.0.0:beta1:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.0.0:beta2:*:*:*:*:*:*","range":[{"introduced":"11.0.0-beta2"},{"last_affected":"11.0.0-beta2"}]},{"cpe":"cpe:2.3:a:digium:asterisk:11.0.0:rc1:*:*:*:*:*:*","range":[{"introduced":"11.0.0-rc1"},{"last_affected":"11.0.0-rc1"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.0.0-rc1"},{"last_affected":"11.0.0-rc1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.0.0:rc1:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:11.0.0:rc2:*:*:*:*:*:*","range":[{"introduced":"11.0.0-rc2"},{"last_affected":"11.0.0-rc2"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.0.0:rc2:*:*:*:*:*:*","range":[{"introduced":"11.0.0-rc2"},{"last_affected":"11.0.0-rc2"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:11.0.1:*:*:*:*:*:*:*","range":[{"introduced":"11.0.1"},{"last_affected":"11.0.1"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.0.2:*:*:*:*:*:*:*","range":[{"introduced":"11.0.2"},{"last_affected":"11.0.2"}]},{"cpe":"cpe:2.3:a:digium:asterisk:11.1.0:*:*:*:*:*:*:*","range":[{"introduced":"11.1.0"},{"last_affected":"11.1.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.1.0:*:*:*:*:*:*:*","range":[{"introduced":"11.1.0"},{"last_affected":"11.1.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.1.0:rc1:*:*:*:*:*:*","range":[{"introduced":"11.1.0-rc1"},{"last_affected":"11.1.0-rc1"}]},{"range":[{"introduced":"11.1.0-rc1"},{"last_affected":"11.1.0-rc1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.1.0:rc1:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:11.1.0:rc3:*:*:*:*:*:*","range":[{"introduced":"11.1.0-rc3"},{"last_affected":"11.1.0-rc3"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.1.0:rc3:*:*:*:*:*:*","range":[{"introduced":"11.1.0-rc3"},{"last_affected":"11.1.0-rc3"}]},{"cpe":"cpe:2.3:a:digium:asterisk:11.1.1:*:*:*:*:*:*:*","range":[{"introduced":"11.1.1"},{"last_affected":"11.1.1"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.1.2"},{"last_affected":"11.1.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.1.2:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:11.2.0:*:*:*:*:*:*:*","range":[{"introduced":"11.2.0"},{"last_affected":"11.2.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.2.0:*:*:*:*:*:*:*","range":[{"introduced":"11.2.0"},{"last_affected":"11.2.0"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.2.0:rc1:*:*:*:*:*:*","range":[{"introduced":"11.2.0-rc1"},{"last_affected":"11.2.0-rc1"}]},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.2.0:rc1:*:*:*:*:*:*","range":[{"introduced":"11.2.0-rc1"},{"last_affected":"11.2.0-rc1"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.2.0-rc2"},{"last_affected":"11.2.0-rc2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.2.0:rc2:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.2.0:rc2:*:*:*:*:*:*","range":[{"introduced":"11.2.0-rc2"},{"last_affected":"11.2.0-rc2"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.2.1:*:*:*:*:*:*:*","range":[{"introduced":"11.2.1"},{"last_affected":"11.2.1"}]},{"range":[{"introduced":"11.2.2"},{"last_affected":"11.2.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.2.2:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:11.3.0:*:*:*:*:*:*:*","range":[{"introduced":"11.3.0"},{"last_affected":"11.3.0"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.3.0"},{"last_affected":"11.3.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.3.0:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.4.0:*:*:*:*:*:*:*","range":[{"introduced":"11.4.0"},{"last_affected":"11.4.0"}]},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.4.0:*:*:*:*:*:*:*","range":[{"introduced":"11.4.0"},{"last_affected":"11.4.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.5.0:*:*:*:*:*:*:*","range":[{"introduced":"11.5.0"},{"last_affected":"11.5.0"}]},{"range":[{"introduced":"11.5.0"},{"last_affected":"11.5.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.5.0:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:11.5.1:*:*:*:*:*:*:*","range":[{"introduced":"11.5.1"},{"last_affected":"11.5.1"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.6.0"},{"last_affected":"11.6.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.6.0:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6.0:*:*:*:lts:*:*:*","range":[{"introduced":"11.6.0"},{"last_affected":"11.6.0"}]},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.6.0:-:*:*:*:*:*:*","range":[{"introduced":"11.6.0-NA"},{"last_affected":"11.6.0-NA"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.6.1:*:*:*:*:*:*:*","range":[{"introduced":"11.6.1"},{"last_affected":"11.6.1"}]},{"range":[{"introduced":"11.6-cert1"},{"last_affected":"11.6-cert1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert1:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert1:*:*:lts:*:*:*","range":[{"introduced":"11.6-cert1"},{"last_affected":"11.6-cert1"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.7.0"},{"last_affected":"11.7.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.7.0:*:*:*:*:*:*:*"},{"range":[{"introduced":"11.8.0"},{"last_affected":"11.8.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.8.0:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.8.1:*:*:*:*:*:*:*","range":[{"introduced":"11.8.1"},{"last_affected":"11.8.1"}]},{"cpe":"cpe:2.3:a:digium:asterisk:11.9.0:*:*:*:*:*:*:*","range":[{"introduced":"11.9.0"},{"last_affected":"11.9.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:11.10.0:*:*:*:*:*:*:*","range":[{"introduced":"11.10.0"},{"last_affected":"11.10.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:11.10.1:*:*:*:*:*:*:*","range":[{"introduced":"11.10.1"},{"last_affected":"11.10.1"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:11.10.2:*:*:*:*:*:*:*","range":[{"introduced":"11.10.2"},{"last_affected":"11.10.2"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:11.11.0:*:*:*:*:*:*:*","range":[{"introduced":"11.11.0"},{"last_affected":"11.11.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.12.0:*:*:*:*:*:*:*","range":[{"introduced":"11.12.0"},{"last_affected":"11.12.0"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.12.1:*:*:*:*:*:*:*","range":[{"introduced":"11.12.1"},{"last_affected":"11.12.1"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.13.0:*:*:*:*:*:*:*","range":[{"introduced":"11.13.0"},{"last_affected":"11.13.0"}]},{"cpe":"cpe:2.3:a:digium:asterisk:11.13.1:*:*:*:*:*:*:*","range":[{"introduced":"11.13.1"},{"last_affected":"11.13.1"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:11.14.0:*:*:*:*:*:*:*","range":[{"introduced":"11.14.0"},{"last_affected":"11.14.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.14.1:*:*:*:*:*:*:*","range":[{"introduced":"11.14.1"},{"last_affected":"11.14.1"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.14.2:*:*:*:*:*:*:*","range":[{"introduced":"11.14.2"},{"last_affected":"11.14.2"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.15.0:*:*:*:*:*:*:*","range":[{"introduced":"11.15.0"},{"last_affected":"11.15.0"}]},{"range":[{"introduced":"11.15.1"},{"last_affected":"11.15.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.15.1:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:11.16.0:*:*:*:*:*:*:*","range":[{"introduced":"11.16.0"},{"last_affected":"11.16.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.17.0:*:*:*:*:*:*:*","range":[{"introduced":"11.17.0"},{"last_affected":"11.17.0"}]},{"range":[{"introduced":"11.17.1"},{"last_affected":"11.17.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.17.1:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:11.18.0:*:*:*:*:*:*:*","range":[{"introduced":"11.18.0"},{"last_affected":"11.18.0"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.19.0"},{"last_affected":"11.19.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.19.0:*:*:*:*:*:*:*"},{"range":[{"introduced":"11.20.0"},{"last_affected":"11.20.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.20.0:*:*:*:*:*:*:*"},{"range":[{"introduced":"11.21.0"},{"last_affected":"11.21.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.21.0:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:11.21.1:*:*:*:*:*:*:*","range":[{"introduced":"11.21.1"},{"last_affected":"11.21.1"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.21.2:*:*:*:*:*:*:*","range":[{"introduced":"11.21.2"},{"last_affected":"11.21.2"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.22.0:*:*:*:*:*:*:*","range":[{"introduced":"11.22.0"},{"last_affected":"11.22.0"}]},{"range":[{"introduced":"11.22.0-rc1"},{"last_affected":"11.22.0-rc1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.22.0:rc1:*:*:*:*:*:*"},{"range":[{"introduced":"11.23.0"},{"last_affected":"11.23.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.23.0:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:11.23.0:rc1:*:*:*:*:*:*","range":[{"introduced":"11.23.0-rc1"},{"last_affected":"11.23.0-rc1"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.23.1"},{"last_affected":"11.23.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.23.1:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:11.24.0:*:*:*:*:*:*:*","range":[{"introduced":"11.24.0"},{"last_affected":"11.24.0"}]},{"cpe":"cpe:2.3:a:digium:asterisk:11.24.1:*:*:*:*:*:*:*","range":[{"introduced":"11.24.1"},{"last_affected":"11.24.1"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:11.25.0:*:*:*:*:*:*:*","range":[{"introduced":"11.25.0"},{"last_affected":"11.25.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:13.0.0:*:*:*:*:*:*:*","range":[{"introduced":"13.0.0"},{"last_affected":"13.0.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.0.0:beta1:*:*:*:*:*:*","range":[{"introduced":"13.0.0-beta1"},{"last_affected":"13.0.0-beta1"}]},{"range":[{"introduced":"13.0.0-beta2"},{"last_affected":"13.0.0-beta2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.0.0:beta2:*:*:*:*:*:*"},{"range":[{"introduced":"13.0.0-beta3"},{"last_affected":"13.0.0-beta3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.0.0:beta3:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:13.0.1:*:*:*:*:*:*:*","range":[{"introduced":"13.0.1"},{"last_affected":"13.0.1"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.0.2:*:*:*:*:*:*:*","range":[{"introduced":"13.0.2"},{"last_affected":"13.0.2"}]},{"cpe":"cpe:2.3:a:digium:asterisk:13.1.0:*:*:*:*:*:*:*","range":[{"introduced":"13.1.0"},{"last_affected":"13.1.0"}],"source":"CPE_STRING"},{"range":[{"introduced":"13.1.1"},{"last_affected":"13.1.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.1.1:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.2.0:*:*:*:*:*:*:*","range":[{"introduced":"13.2.0"},{"last_affected":"13.2.0"}]},{"cpe":"cpe:2.3:a:digium:asterisk:13.2.1:*:*:*:*:*:*:*","range":[{"introduced":"13.2.1"},{"last_affected":"13.2.1"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:13.3.0:*:*:*:*:*:*:*","range":[{"introduced":"13.3.0"},{"last_affected":"13.3.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:13.3.1:*:*:*:*:*:*:*","range":[{"introduced":"13.3.1"},{"last_affected":"13.3.1"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:13.3.2:*:*:*:*:*:*:*","range":[{"introduced":"13.3.2"},{"last_affected":"13.3.2"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.4.0:*:*:*:*:*:*:*","range":[{"introduced":"13.4.0"},{"last_affected":"13.4.0"}]},{"cpe":"cpe:2.3:a:digium:asterisk:13.5.0:*:*:*:*:*:*:*","range":[{"introduced":"13.5.0"},{"last_affected":"13.5.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.6.0:*:*:*:*:*:*:*","range":[{"introduced":"13.6.0"},{"last_affected":"13.6.0"}]},{"cpe":"cpe:2.3:a:digium:asterisk:13.7.0:*:*:*:*:*:*:*","range":[{"introduced":"13.7.0"},{"last_affected":"13.7.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:13.7.1:*:*:*:*:*:*:*","range":[{"introduced":"13.7.1"},{"last_affected":"13.7.1"}],"source":"CPE_STRING"},{"range":[{"introduced":"13.7.2"},{"last_affected":"13.7.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.7.2:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:13.8.0:*:*:*:*:*:*:*","range":[{"introduced":"13.8.0"},{"last_affected":"13.8.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:13.8.0:rc1:*:*:*:*:*:*","range":[{"introduced":"13.8.0-rc1"},{"last_affected":"13.8.0-rc1"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:13.8.1:*:*:*:*:*:*:*","range":[{"introduced":"13.8.1"},{"last_affected":"13.8.1"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.8.2:*:*:*:*:*:*:*","range":[{"introduced":"13.8.2"},{"last_affected":"13.8.2"}]},{"cpe":"cpe:2.3:a:digium:asterisk:13.9.0:*:*:*:*:*:*:*","range":[{"introduced":"13.9.0"},{"last_affected":"13.9.0"}],"source":"CPE_STRING"},{"range":[{"introduced":"13.9.1"},{"last_affected":"13.9.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.9.1:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.10.0:*:*:*:*:*:*:*","range":[{"introduced":"13.10.0"},{"last_affected":"13.10.0"}]},{"range":[{"introduced":"13.10.0-rc1"},{"last_affected":"13.10.0-rc1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.10.0:rc1:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:13.11.0:*:*:*:*:*:*:*","range":[{"introduced":"13.11.0"},{"last_affected":"13.11.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:asterisk:13.11.1:*:*:*:*:*:*:*","range":[{"introduced":"13.11.1"},{"last_affected":"13.11.1"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.11.2:*:*:*:*:*:*:*","range":[{"introduced":"13.11.2"},{"last_affected":"13.11.2"}]},{"range":[{"introduced":"13.12.0"},{"last_affected":"13.12.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.12.0:*:*:*:*:*:*:*"},{"range":[{"introduced":"13.12.1"},{"last_affected":"13.12.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.12.1:*:*:*:*:*:*:*"},{"range":[{"introduced":"13.12.2"},{"last_affected":"13.12.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.12.2:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:13.13.0:*:*:*:*:*:*:*","range":[{"introduced":"13.13.0"},{"last_affected":"13.13.0"}]},{"range":[{"introduced":"14.0.0"},{"last_affected":"14.0.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:14.0.0:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:asterisk:14.0.0:beta1:*:*:*:*:*:*","range":[{"introduced":"14.0.0-beta1"},{"last_affected":"14.0.0-beta1"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:14.0.0:beta2:*:*:*:*:*:*","range":[{"introduced":"14.0.0-beta2"},{"last_affected":"14.0.0-beta2"}]},{"range":[{"introduced":"14.0.0-rc1"},{"last_affected":"14.0.0-rc1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:14.0.0:rc1:*:*:*:*:*:*"},{"range":[{"introduced":"14.0.0-rc2"},{"last_affected":"14.0.0-rc2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:14.0.0:rc2:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:14.0.1:*:*:*:*:*:*:*","range":[{"introduced":"14.0.1"},{"last_affected":"14.0.1"}]},{"range":[{"introduced":"14.0.2"},{"last_affected":"14.0.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:14.0.2:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:14.1.0:*:*:*:*:*:*:*","range":[{"introduced":"14.1.0"},{"last_affected":"14.1.0"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:14.1.1:*:*:*:*:*:*:*","range":[{"introduced":"14.1.1"},{"last_affected":"14.1.1"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:asterisk:14.1.2:*:*:*:*:*:*:*","range":[{"introduced":"14.1.2"},{"last_affected":"14.1.2"}]},{"cpe":"cpe:2.3:a:digium:asterisk:14.2.0:*:*:*:*:*:*:*","range":[{"introduced":"14.2.0"},{"last_affected":"14.2.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.1.0:rc2:*:*:*:*:*:*","range":[{"introduced":"11.1.0-rc2"},{"last_affected":"11.1.0-rc2"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.3.0:rc1:*:*:*:*:*:*","range":[{"introduced":"11.3.0-rc1"},{"last_affected":"11.3.0-rc1"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.3.0-rc2"},{"last_affected":"11.3.0-rc2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.3.0:rc2:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.4.0:rc1:*:*:*:*:*:*","range":[{"introduced":"11.4.0-rc1"},{"last_affected":"11.4.0-rc1"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.4.0:rc2:*:*:*:*:*:*","range":[{"introduced":"11.4.0-rc2"},{"last_affected":"11.4.0-rc2"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.4.0-rc3"},{"last_affected":"11.4.0-rc3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.4.0:rc3:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.5.0:rc1:*:*:*:*:*:*","range":[{"introduced":"11.5.0-rc1"},{"last_affected":"11.5.0-rc1"}]},{"range":[{"introduced":"11.5.0-rc2"},{"last_affected":"11.5.0-rc2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.5.0:rc2:*:*:*:*:*:*"},{"range":[{"introduced":"11.6-cert1_rc1"},{"last_affected":"11.6-cert1_rc1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert1_rc1:*:*:*:*:*:*"},{"range":[{"introduced":"11.6-cert1_rc2"},{"last_affected":"11.6-cert1_rc2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert1_rc2:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert10:*:*:lts:*:*:*","range":[{"introduced":"11.6-cert10"},{"last_affected":"11.6-cert10"}],"source":"CPE_STRING"},{"range":[{"introduced":"11.6-cert11"},{"last_affected":"11.6-cert11"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert11:*:*:lts:*:*:*"},{"range":[{"introduced":"11.6-cert12"},{"last_affected":"11.6-cert12"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert12:*:*:lts:*:*:*"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert13:*:*:lts:*:*:*","range":[{"introduced":"11.6-cert13"},{"last_affected":"11.6-cert13"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert14:*:*:lts:*:*:*","range":[{"introduced":"11.6-cert14"},{"last_affected":"11.6-cert14"}]},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert15:*:*:lts:*:*:*","range":[{"introduced":"11.6-cert15"},{"last_affected":"11.6-cert15"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert2:*:*:*:*:*:*","range":[{"introduced":"11.6-cert2"},{"last_affected":"11.6-cert2"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert2:*:*:lts:*:*:*","range":[{"introduced":"11.6-cert2"},{"last_affected":"11.6-cert2"}]},{"range":[{"introduced":"11.6-cert3"},{"last_affected":"11.6-cert3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert3:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert3:*:*:lts:*:*:*","range":[{"introduced":"11.6-cert3"},{"last_affected":"11.6-cert3"}]},{"range":[{"introduced":"11.6-cert4"},{"last_affected":"11.6-cert4"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert4:*:*:lts:*:*:*"},{"range":[{"introduced":"11.6-cert5"},{"last_affected":"11.6-cert5"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert5:*:*:lts:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert6:*:*:lts:*:*:*","range":[{"introduced":"11.6-cert6"},{"last_affected":"11.6-cert6"}]},{"range":[{"introduced":"11.6-cert7"},{"last_affected":"11.6-cert7"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert7:*:*:lts:*:*:*"},{"range":[{"introduced":"11.6-cert8"},{"last_affected":"11.6-cert8"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert8:*:*:lts:*:*:*"},{"range":[{"introduced":"11.6-cert9"},{"last_affected":"11.6-cert9"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6:cert9:*:*:lts:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:digium:certified_asterisk:11.6.0:rc1:*:*:*:*:*:*","range":[{"introduced":"11.6.0-rc1"},{"last_affected":"11.6.0-rc1"}]},{"cpe":"cpe:2.3:a:digium:certified_asterisk:11.6.0:rc2:*:*:*:*:*:*","range":[{"introduced":"11.6.0-rc2"},{"last_affected":"11.6.0-rc2"}],"source":"CPE_STRING"}]}}],"versions":["11.0.0","11.0.0-beta1","11.0.0-beta2","11.0.0-rc1","11.0.0-rc2","11.0.1","11.0.2","11.1.0","11.1.0-rc1","11.1.0-rc2","11.1.0-rc3","11.1.1","11.1.2","11.10.0","11.10.1","11.10.2","11.11.0","11.12.0","11.12.1","11.13.0","11.13.1","11.14.0","11.14.1","11.14.2","11.15.0","11.15.1","11.16.0","11.17.0","11.17.1","11.18.0","11.19.0","11.2.0","11.2.0-rc1","11.2.0-rc2","11.2.1","11.2.2","11.20.0","11.21.0","11.21.1","11.21.2","11.22.0","11.22.0-rc1","11.23.0","11.23.0-rc1","11.23.1","11.24.0","11.24.1","11.25.0","11.3.0","11.3.0-rc1","11.3.0-rc2","11.4.0","11.4.0-rc1","11.4.0-rc2","11.4.0-rc3","11.5.0","11.5.0-rc1","11.5.0-rc2","11.5.1","11.6-cert10","11.6-cert11","11.6-cert12","11.6-cert13","11.6-cert14","11.6-cert15","11.6-cert1_rc1","11.6-cert1_rc2","11.6-cert2","11.6-cert3","11.6-cert4","11.6-cert5","11.6-cert6","11.6-cert7","11.6-cert8","11.6-cert9","11.6.0","11.6.0-rc1","11.6.0-rc2","11.6.1","11.7.0","11.8.0","11.8.1","11.9.0","13.0.0","13.0.0-beta1","13.0.0-beta2","13.0.0-beta3","13.0.1","13.0.2","13.1.0","13.1.1","13.10.0","13.10.0-rc1","13.11.0","13.11.1","13.11.2","13.12.0","13.12.1","13.12.2","13.13.0","13.2.0","13.2.1","13.3.0","13.3.1","13.3.2","13.4.0","13.5.0","13.6.0","13.7.0","13.7.1","13.7.2","13.8.0","13.8.0-rc1","13.8.1","13.8.2","13.9.0","13.9.1","14.0.0","14.0.0-beta1","14.0.0-beta2","14.0.0-rc1","14.0.0-rc2","14.0.1","14.0.2","14.1.0","14.1.1","14.1.2","14.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9938.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}