CVE-2008-2119: Asterisk Business Edition

Medium severity, CVSS 4.3. EPSS: 7.3% chance of exploitation in the next 30 days.

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.

Affected products

• Asterisk Asterisk Business Edition: up to and including b2.5.2; version b.1.3.2 only; version b.1.3.3 only; version b.2.2.0 only; version b.2.2.1 only; version b.2.3.1 only; …
• Asterisk Open Source: up to and including 1.2.28; version 1.0 only; version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; …

Published 2008-06-04. Last modified 2026-06-16.