Asterisk Path Traversal vulnerability
Summary
Asterisk Path Traversal vulnerability
Original description
The description as published by the source.
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the live_dangerously is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2023-49294 asterisk Fixed in: 18.20.2-r0
- Debian DEBIAN-CVE-2023-49294 asterisk Fixed in: 1:16.28.0~dfsg-0+deb11u4
- Ubuntu UBUNTU-CVE-2023-49294 asterisk
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com
- web lists.debian.org