{"id":"UBUNTU-CVE-2023-49786","details":"Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1; as well as certified-asterisk prior to 18.9-cert6; Asterisk is susceptible to a DoS due to a race condition in the hello handshake phase of the DTLS protocol when handling DTLS-SRTP for media setup. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable Asterisk servers for calls that rely on DTLS-SRTP. Commit d7d7764cb07c8a1872804321302ef93bf62cba05 contains a fix, which is part of versions 18.20.1, 20.5.1, 21.0.1, amd 18.9-cert6.","modified":"2026-05-20T16:13:57.396802713Z","published":"2023-12-14T20:15:00Z","upstream":["CVE-2023-49786"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-49786"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2023-49786"}],"affected":[{"package":{"name":"asterisk","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=esm-apps%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.1.0~dfsg-1.1ubuntu3","1:13.1.0~dfsg-1.1ubuntu4","1:13.1.0~dfsg-1.1ubuntu4.1","1:13.1.0~dfsg-1.1ubuntu4.1+esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-config"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-dahdi"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-mobile"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-modules"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-mp3"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-mysql"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-ooh323"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-voicemail"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-voicemail-imapstorage"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-voicemail-odbcstorage"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-vpb"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-49786.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.17.2~dfsg-1ubuntu1","1:13.17.2~dfsg-2ubuntu1","1:13.18.1~dfsg-1ubuntu1","1:13.18.3~dfsg-1ubuntu1","1:13.18.3~dfsg-1ubuntu2","1:13.18.3~dfsg-1ubuntu3","1:13.18.3~dfsg-1ubuntu4"],"ecosystem_specific":{"binaries":[{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-config"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-dahdi"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-mobile"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-modules"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-mp3"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-mysql"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-ooh323"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-tests"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-voicemail"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-voicemail-imapstorage"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-voicemail-odbcstorage"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-vpb"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-49786.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:16.2.1~dfsg-2build2","1:16.2.1~dfsg-2build3","1:16.2.1~dfsg-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-config"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-dahdi"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-mobile"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-modules"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-mp3"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-mysql"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-ooh323"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-tests"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-voicemail"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-voicemail-imapstorage"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-voicemail-odbcstorage"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-vpb"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-49786.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:16.16.1~dfsg-2","1:16.16.1~dfsg-4","1:16.16.1~dfsg-4build1","1:16.16.1~dfsg+~2.10-1","1:18.10.0~dfsg+~cs6.10.40431411-2"],"ecosystem_specific":{"binaries":[{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-config"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-dahdi"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-mobile"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-modules"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-mp3"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-mysql"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-ooh323"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-tests"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-vpb"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-49786.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20.4.0~dfsg+~cs6.13.40431414-2","1:20.5.0~dfsg+~cs6.13.40431414-1","1:20.5.1~dfsg+~cs6.13.40431414-1","1:20.5.2~dfsg+~cs6.13.40431414-1","1:20.6.0~dfsg+~cs6.13.40431414-1","1:20.6.0~dfsg+~cs6.13.40431414-2","1:20.6.0~dfsg+~cs6.13.40431414-2build3","1:20.6.0~dfsg+~cs6.13.40431414-2build4","1:20.6.0~dfsg+~cs6.13.40431414-2build5"],"ecosystem_specific":{"binaries":[{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-config"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-dahdi"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-mobile"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-modules"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-mp3"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-mysql"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-ooh323"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-tests"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-49786.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:22.2.0~dfsg+~cs6.15.60671435-2","1:22.3.0~dfsg+~cs6.15.60671435-1","1:22.4.1~dfsg+~cs6.15.60671435-1","1:22.4.1~dfsg+~cs6.15.60671435-2","1:22.5.1~dfsg+~cs6.15.60671435-1","1:22.5.2~dfsg+~cs6.15.60671435-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-config"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-dahdi"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mobile"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-modules"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mp3"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mysql"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-ooh323"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-tests"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-49786.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:22.5.2~dfsg+~cs6.15.60671435-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-config"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-dahdi"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mobile"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-modules"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mp3"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mysql"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-ooh323"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-tests"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-49786.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}