Asterisk · Asterisk · CVE-2021-32558
**Name of the Vulnerable Software and Affected Versions**
Asterisk versions 13.x through 13.38.2
Asterisk versions 16.x through 16.19.0
Asterisk versions 17.x through 17.9.3
Asterisk versions 18.x through 18.5.0
Certified Asterisk versions prior to 16.8-cert10
**Description**
The issue is related to insufficient input validation. If the IAX2 channel driver receives a packet containing an unsupported media format, a crash can occur, allowing a remote attacker to execute a denial-of-service (DoS) attack by sending a specially crafted request.
**Recommendations**
For Asterisk versions 13.x through 13.38.2, update to version 13.38.3 or later.
For Asterisk versions 16.x through 16.19.0, update to version 16.19.1 or later.
For Asterisk versions 17.x through 17.9.3, update to version 17.9.4 or later.
For Asterisk versions 18.x through 18.5.0, update to version 18.5.1 or later.
For Certified Asterisk versions prior to 16.8-cert10, update to version 16.8-cert10 or later.