{"id":"CVE-2024-42491","summary":"A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used","details":"Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with `.1` or `[.1]`, and res_resolver_unbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable res_resolver_unbound by setting `noload = res_resolver_unbound.so` in modules.conf, or set `rewrite_contact = yes` on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.","aliases":["GHSA-v428-g3cw-7hv9"],"modified":"2026-08-12T15:15:27.562239Z","published":"2024-09-05T17:17:56.961Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-252","CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42491.json"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00016.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42491.json"},{"type":"ADVISORY","url":"https://github.com/asterisk/asterisk/security/advisories/GHSA-v428-g3cw-7hv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42491"},{"type":"FIX","url":"https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4"},{"type":"FIX","url":"https://github.com/asterisk/asterisk/commit/4f01669c7c41c9184f3cce9a3cf1b2ebf6201742"},{"type":"FIX","url":"https://github.com/asterisk/asterisk/commit/50bf8d4d3064930d28ecf1ce3397b14574d514d2"},{"type":"FIX","url":"https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8"},{"type":"FIX","url":"https://github.com/asterisk/asterisk/commit/a15050650abf09c10a3c135fab148220cd41d3a0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asterisk/asterisk","events":[{"introduced":"0"},{"fixed":"f8dddb0e3d8baa3e0649f0e878305f3f810016ac"},{"fixed":"85601849c646709836f59007d04ca829ef0d5955"},{"introduced":"c6c7103efa6605a6db7ca28b4b17cd2d1c15a05c"},{"fixed":"c5e30b7e157b67ec6dba64d3b1a3a3cac907e524"},{"introduced":"12da95e53ff42287ad69d6d5922e06c3d62010ac"},{"last_affected":"489a05f269e005242027ab47d37fb6b6a1651989"},{"introduced":"85601849c646709836f59007d04ca829ef0d5955"},{"fixed":"42a2f4ccfa2c7062a15063e765916b3332e34cc4"},{"fixed":"4f01669c7c41c9184f3cce9a3cf1b2ebf6201742"},{"fixed":"50bf8d4d3064930d28ecf1ce3397b14574d514d2"},{"fixed":"7a0090325bfa9d778a39ae5f7d0a98109e4651c8"},{"fixed":"a15050650abf09c10a3c135fab148220cd41d3a0"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"18.24.3"},{"fixed":"18.9"},{"introduced":"20.0.0"},{"fixed":"20.9.3"},{"introduced":"21.0.0"},{"last_affected":"21.4.3"},{"introduced":"18.9-NA"},{"last_affected":"18.9-NA"},{"introduced":"18.9-cert1"},{"last_affected":"18.9-cert1"},{"introduced":"18.9-cert1\\-rc1"},{"last_affected":"18.9-cert1\\-rc1"},{"introduced":"18.9-cert10"},{"last_affected":"18.9-cert10"},{"introduced":"18.9-cert11"},{"last_affected":"18.9-cert11"},{"introduced":"18.9-cert2"},{"last_affected":"18.9-cert2"},{"introduced":"18.9-cert3"},{"last_affected":"18.9-cert3"},{"introduced":"18.9-cert4"},{"last_affected":"18.9-cert4"},{"introduced":"18.9-cert5"},{"last_affected":"18.9-cert5"},{"introduced":"18.9-cert6"},{"last_affected":"18.9-cert6"},{"introduced":"18.9-cert7"},{"last_affected":"18.9-cert7"},{"introduced":"18.9-cert8"},{"last_affected":"18.9-cert8"},{"introduced":"18.9-cert8\\-rc1"},{"last_affected":"18.9-cert8\\-rc1"},{"introduced":"18.9-cert8\\-rc2"},{"last_affected":"18.9-cert8\\-rc2"},{"introduced":"18.9-cert9"},{"last_affected":"18.9-cert9"},{"introduced":"20.7-cert1"},{"last_affected":"20.7-cert1"},{"introduced":"20.7-cert1\\-rc1"},{"last_affected":"20.7-cert1\\-rc1"},{"introduced":"20.7-cert1\\-rc2"},{"last_affected":"20.7-cert1\\-rc2"},{"introduced":"20.7-cert2"},{"last_affected":"20.7-cert2"}]}}],"versions":["18.9-NA","18.9-cert1","18.9-cert10","18.9-cert11","18.9-cert1\\-rc1","18.9-cert2","18.9-cert3","18.9-cert4","18.9-cert5","18.9-cert6","18.9-cert7","18.9-cert8","18.9-cert8\\-rc1","18.9-cert8\\-rc2","18.9-cert9","20.7-cert1","20.7-cert1\\-rc1","20.7-cert1\\-rc2","20.7-cert2","21.4.3","21.4.2","20.9.2","18.24.2","21.4.1","20.9.1","18.24.1","certified-20.7-cert1","certified-18.9-cert10","18.24.0","20.9.0","21.4.0","21.4.0-rc1","20.9.0-rc1","18.24.0-rc1","certified-20.7-cert1-rc2","certified-18.9-cert9","21.3.1","20.8.1","18.23.1","21.3.0","20.8.0","18.23.0","21.3.0-rc1","20.8.0-rc1","18.23.0-rc1","certified-20.7-cert1-rc1","certified-18.9-cert8","certified-20.7-cert1-pre1","20.7.0","21.2.0","18.22.0","21.2.0-rc2","20.7.0-rc2","18.22.0-rc2","certified-18.9-cert8-rc2","20.7.0-rc1","18.22.0-rc1","21.2.0-rc1","21.1.0","20.6.0","18.21.0","certified-18.9-cert8-rc1","certified-18.9-cert7","21.1.0-rc2","20.6.0-rc2","18.21.0-rc2","21.1.0-rc1","20.6.0-rc1","18.21.0-rc1","21.0.2","20.5.2","18.20.2","certified-18.9-cert6","18.20.1","20.5.1","21.0.1","certified-18.9-cert5","21.0.0","20.5.0","18.20.0","20.5.0-rc1","18.20.0-rc1","20.4.0","18.19.0","18.19.0-rc2","20.4.0-rc2","20.4.0-rc1","18.19.0-rc1","20.3.1","18.18.1","certified/18.9-cert4","certified-18.9-cert4","20.3.0","18.18.0","20.3.0-rc1","18.18.0-rc1","20.2.1","18.17.1","20.2.0","18.17.0","20.2.0-rc1","18.17.0-rc1","certified/18.9-cert3","certified/18.9-cert2","certified/18.9-cert1","certified/18.9-cert1-rc1","18.9.0","18.9.0-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42491.json","vanir_signatures_modified":"2026-08-12T15:15:27Z","vanir_signatures":[{"source":"https://github.com/asterisk/asterisk/commit/4f01669c7c41c9184f3cce9a3cf1b2ebf6201742","target":{"file":"res/res_resolver_unbound.c","function":"off_nominal_sync_run"},"deprecated":false,"digest":{"function_hash":"35532313092464776673311802766554748424","length":607},"id":"CVE-2024-42491-02f8bd26","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"57922630928494882635671196105702837533","length":1345},"id":"CVE-2024-42491-0c14c04d","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/50bf8d4d3064930d28ecf1ce3397b14574d514d2","target":{"file":"res/res_resolver_unbound.c","function":"off_nominal_test"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/a15050650abf09c10a3c135fab148220cd41d3a0","target":{"file":"res/res_resolver_unbound.c","function":"unbound_resolver_callback"},"deprecated":false,"digest":{"function_hash":"70641475278107543980698323705944437641","length":547},"id":"CVE-2024-42491-0fed6bf9"},{"id":"CVE-2024-42491-1f9a0e1f","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/a15050650abf09c10a3c135fab148220cd41d3a0","target":{"file":"res/res_resolver_unbound.c","function":"off_nominal_sync_run"},"deprecated":false,"digest":{"function_hash":"35532313092464776673311802766554748424","length":607}},{"deprecated":false,"digest":{"function_hash":"281396724673345422001643455093444861812","length":118},"id":"CVE-2024-42491-20ab1367","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/a15050650abf09c10a3c135fab148220cd41d3a0","target":{"file":"main/dns_core.c","function":"ast_dns_resolver_completed"}},{"digest":{"line_hashes":["93104383002288362320630301365710545430","36061282823684201964105431048590206630","311674305717262396020965858880497248734","177531054042277794214552351487290198599","285932047014592983756128495756905966224","157708836019795874492211437074139921257","52777681262907263925257461006496574486","317464940260836631471627085009392614579","98352624013926265063276692818134945640","231114445002317881968549376093572746040","38552070738182780360479586113621786932","186040178685883689650093646392097633989","234326707178399511318849369232461188497","165424270237914492273178293855631932423","32626974431462587087698936219868300191"],"threshold":0.9},"id":"CVE-2024-42491-40c4bed9","signature_type":"Line","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/4f01669c7c41c9184f3cce9a3cf1b2ebf6201742","target":{"file":"res/res_resolver_unbound.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"232703403506518374731596977575200181777","length":5343},"id":"CVE-2024-42491-41137e8e","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4","target":{"file":"main/manager.c","function":"action_originate"}},{"id":"CVE-2024-42491-4e72c0fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/a15050650abf09c10a3c135fab148220cd41d3a0","target":{"file":"res/res_resolver_unbound.c","function":"off_nominal_test"},"deprecated":false,"digest":{"function_hash":"57922630928494882635671196105702837533","length":1345}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["330083386143230897860645627042872122397","135458073016617245683244807501187529424","60033089452914022413512870798842650543","316824714912647114610842803631927843330","274807132997725124570029074467748754423","295927908401415594913179399400800381275","247155707204245380668433602252893744860","144401246708952014752911080933458126352","103597149692434822907490553740580318234","43733839804770866268421438718883615057","174688976415292125217161812871754725646","272116292709699004460503924397067593483","2776275004956605641158109646656848331","187524471302074971220675724334739476446","101928226929111395888281062233454403917","138985238550026917485626545431846360826","260379234745971463118281333239484257831","306713559133014621805675062700540987106","44505279969845405466588382943414654232","12844842932451369550652892076403609271","100835194887530738481442659800828727660"]},"id":"CVE-2024-42491-5803e02b","signature_type":"Line","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8","target":{"file":"main/manager.c"}},{"deprecated":false,"digest":{"function_hash":"281396724673345422001643455093444861812","length":118},"id":"CVE-2024-42491-5afbfc6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/4f01669c7c41c9184f3cce9a3cf1b2ebf6201742","target":{"file":"main/dns_core.c","function":"ast_dns_resolver_completed"}},{"source":"https://github.com/asterisk/asterisk/commit/a15050650abf09c10a3c135fab148220cd41d3a0","target":{"file":"res/res_resolver_unbound.c"},"deprecated":false,"digest":{"line_hashes":["93104383002288362320630301365710545430","36061282823684201964105431048590206630","311674305717262396020965858880497248734","177531054042277794214552351487290198599","285932047014592983756128495756905966224","157708836019795874492211437074139921257","52777681262907263925257461006496574486","317464940260836631471627085009392614579","98352624013926265063276692818134945640","231114445002317881968549376093572746040","38552070738182780360479586113621786932","186040178685883689650093646392097633989","234326707178399511318849369232461188497","165424270237914492273178293855631932423","32626974431462587087698936219868300191"],"threshold":0.9},"id":"CVE-2024-42491-7029607f","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/asterisk/asterisk/commit/50bf8d4d3064930d28ecf1ce3397b14574d514d2","target":{"function":"unbound_resolver_callback","file":"res/res_resolver_unbound.c"},"deprecated":false,"digest":{"length":547,"function_hash":"70641475278107543980698323705944437641"},"id":"CVE-2024-42491-77de5227","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4","target":{"file":"main/manager.c"},"deprecated":false,"digest":{"line_hashes":["330083386143230897860645627042872122397","135458073016617245683244807501187529424","60033089452914022413512870798842650543","316824714912647114610842803631927843330","274807132997725124570029074467748754423","295927908401415594913179399400800381275","247155707204245380668433602252893744860","144401246708952014752911080933458126352","103597149692434822907490553740580318234","43733839804770866268421438718883615057","174688976415292125217161812871754725646","272116292709699004460503924397067593483","2776275004956605641158109646656848331","187524471302074971220675724334739476446","101928226929111395888281062233454403917","138985238550026917485626545431846360826","260379234745971463118281333239484257831","306713559133014621805675062700540987106","44505279969845405466588382943414654232","12844842932451369550652892076403609271","100835194887530738481442659800828727660"],"threshold":0.9},"id":"CVE-2024-42491-7e6e8c38","signature_type":"Line"},{"target":{"file":"main/manager.c","function":"action_originate"},"deprecated":false,"digest":{"function_hash":"252776182087257656298008582200932970026","length":5366},"id":"CVE-2024-42491-bff90075","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8"},{"id":"CVE-2024-42491-d6cd72c8","signature_type":"Line","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/50bf8d4d3064930d28ecf1ce3397b14574d514d2","target":{"file":"main/dns_core.c"},"deprecated":false,"digest":{"line_hashes":["149967133664613292454210705176850299818","79560722623311736986086704738404728451","170039978738719970640300767266738782262","56061527538201568660717818799526130432"],"threshold":0.9}},{"source":"https://github.com/asterisk/asterisk/commit/4f01669c7c41c9184f3cce9a3cf1b2ebf6201742","target":{"file":"main/dns_core.c"},"deprecated":false,"digest":{"line_hashes":["149967133664613292454210705176850299818","79560722623311736986086704738404728451","170039978738719970640300767266738782262","56061527538201568660717818799526130432"],"threshold":0.9},"id":"CVE-2024-42491-dd511e41","signature_type":"Line","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["149967133664613292454210705176850299818","79560722623311736986086704738404728451","170039978738719970640300767266738782262","56061527538201568660717818799526130432"]},"id":"CVE-2024-42491-e49d0082","signature_type":"Line","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/a15050650abf09c10a3c135fab148220cd41d3a0","target":{"file":"main/dns_core.c"},"deprecated":false},{"id":"CVE-2024-42491-e71efe02","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/50bf8d4d3064930d28ecf1ce3397b14574d514d2","target":{"file":"res/res_resolver_unbound.c","function":"off_nominal_sync_run"},"deprecated":false,"digest":{"function_hash":"35532313092464776673311802766554748424","length":607}},{"signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/4f01669c7c41c9184f3cce9a3cf1b2ebf6201742","target":{"file":"res/res_resolver_unbound.c","function":"unbound_resolver_callback"},"deprecated":false,"digest":{"function_hash":"70641475278107543980698323705944437641","length":547},"id":"CVE-2024-42491-e8ec1e81","signature_type":"Function"},{"source":"https://github.com/asterisk/asterisk/commit/50bf8d4d3064930d28ecf1ce3397b14574d514d2","target":{"file":"res/res_resolver_unbound.c"},"deprecated":false,"digest":{"line_hashes":["93104383002288362320630301365710545430","36061282823684201964105431048590206630","311674305717262396020965858880497248734","177531054042277794214552351487290198599","285932047014592983756128495756905966224","157708836019795874492211437074139921257","52777681262907263925257461006496574486","317464940260836631471627085009392614579","98352624013926265063276692818134945640","231114445002317881968549376093572746040","38552070738182780360479586113621786932","186040178685883689650093646392097633989","234326707178399511318849369232461188497","165424270237914492273178293855631932423","32626974431462587087698936219868300191"],"threshold":0.9},"id":"CVE-2024-42491-f7b58514","signature_type":"Line","signature_version":"v1"},{"target":{"file":"main/dns_core.c","function":"ast_dns_resolver_completed"},"deprecated":false,"digest":{"function_hash":"281396724673345422001643455093444861812","length":118},"id":"CVE-2024-42491-fb1b485f","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/50bf8d4d3064930d28ecf1ce3397b14574d514d2"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/4f01669c7c41c9184f3cce9a3cf1b2ebf6201742","target":{"function":"off_nominal_test","file":"res/res_resolver_unbound.c"},"deprecated":false,"digest":{"function_hash":"57922630928494882635671196105702837533","length":1345},"id":"CVE-2024-42491-fd97285d"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"}]}