Asterisk vulnerabilities

3 known vulnerabilities in Asterisk from Digium. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Asterisk: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2022-26651Apr 15, 2022DigiumEPSS 7.03%

  An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL

• 9.1 Critical severity

  Asterisk: Server-Side Request Forgery

  CVE-2022-26499Apr 15, 2022DigiumEPSS 7.74%

  An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

• 7.5 High severity

  Asterisk: Uncontrolled Resource Consumption

  CVE-2022-26498Apr 15, 2022DigiumEPSS 16.5%

  An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.2