CVE-2014-2287

Published Apr 18, 2014 CVSS 2.0 · 3.5 Low EPSS 2.4% KEV · Not listed
Description
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-781-1 asterisk security update
Debian DLA Debian DLA DLA-781-2 asterisk regression update
History
Type Values Removed Values Added
Metrics epss

{'score': 0.27885}

epss

{'score': 0.22862}

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 6, 2024, 10:06 AM
Reserved
Mar 5, 2014, 12:00 AM
Status
Modified
Published
Apr 18, 2014, 10:14 PM
Modified
Jun 17, 2026, 12:06 AM