Digium vulnerabilities
We track 3 vulnerabilities in Digium products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on April 15, 2022.
Latest Digium vulnerabilities
- 9.8 Critical severity
Asterisk: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL
- 9.1 Critical severity
Asterisk: Server-Side Request Forgery
An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
- 7.5 High severity
Asterisk: Uncontrolled Resource Consumption
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.2