未評価
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files coul...
CVE-2022-26498
SecPulse初出
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2022-26498 asterisk 修正版: 18.11.2-r0
- Debian DEBIAN-CVE-2022-26498 asterisk 修正版: 1:16.28.0~dfsg-0+deb11u1
- Ubuntu UBUNTU-CVE-2022-26498 asterisk
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory debian.org
- web packetstormsecurity.com
- web packetstormsecurity.com
- web downloads.asterisk.org
- web downloads.asterisk.org
- web lists.debian.org