Unrated
An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via...
CVE-2022-42706
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-42706 asterisk Fixed in: 18.20.2-r0
- Debian DEBIAN-CVE-2022-42706 asterisk Fixed in: 1:16.28.0~dfsg-0+deb11u2
- Ubuntu UBUNTU-CVE-2022-42706 asterisk
Original description The description as published by the source.
An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to access files outside of the asterisk configuration directory, aka Directory Traversal.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory debian.org
- web downloads.asterisk.org
- web lists.debian.org