CVE-2022-42705

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to c...

Original description

The description as published by the source.

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscription via a reliable transport at the same time that Asterisk is also performing activity on that subscription.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2022-42705 asterisk Fixed in: 18.20.2-r0
Debian DEBIAN-CVE-2022-42705 asterisk Fixed in: 1:16.28.0~dfsg-0+deb11u2
Ubuntu UBUNTU-CVE-2022-42705 asterisk

References

advisory github.com
advisory nvd.nist.gov
advisory debian.org
web downloads.asterisk.org
web lists.debian.org