Unrated
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files coul...
CVE-2022-26498
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-26498 asterisk Fixed in: 18.11.2-r0
- Debian DEBIAN-CVE-2022-26498 asterisk Fixed in: 1:16.28.0~dfsg-0+deb11u1
- Ubuntu UBUNTU-CVE-2022-26498 asterisk
Original description The description as published by the source.
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory debian.org
- web packetstormsecurity.com
- web packetstormsecurity.com
- web downloads.asterisk.org
- web downloads.asterisk.org
- web lists.debian.org