Unrated

An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces su...

CVE-2022-26499 First seen on SecPulse Apr 15, 2022

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2022-26499 asterisk Fixed in: 18.11.2-r0
Debian DEBIAN-CVE-2022-26499 asterisk Fixed in: 1:16.28.0~dfsg-0+deb11u1
Ubuntu UBUNTU-CVE-2022-26499 asterisk

Original description The description as published by the source.

An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

Key facts

Severity: Unrated
Published: Apr 15, 2022
First seen on SecPulse: Apr 15, 2022

NVD OSV

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 20, 19:56