An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/166745/Asterisk-Project-Security-Advisory-AST-2022-002.html | Patch Third Party Advisory VDB Entry |
https://downloads.asterisk.org/pub/security/ | Vendor Advisory |
https://downloads.asterisk.org/pub/security/AST-2022-002.html | Patch Vendor Advisory |
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html | Issue Tracking Third Party Advisory |
https://www.debian.org/security/2022/dsa-5285 | Third Party Advisory |
Configurations
History
02 Feb 2023, 18:47
Type | Values Removed | Values Added |
---|---|---|
First Time |
Debian
Debian debian Linux |
|
CPE | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
|
References | (MLIST) https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - Issue Tracking, Third Party Advisory | |
References | (DEBIAN) https://www.debian.org/security/2022/dsa-5285 - Third Party Advisory |
18 Nov 2022, 16:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
17 Nov 2022, 14:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
22 Apr 2022, 17:47
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://downloads.asterisk.org/pub/security/AST-2022-002.html - Patch, Vendor Advisory | |
References | (MISC) https://downloads.asterisk.org/pub/security/ - Vendor Advisory | |
References | (MISC) http://packetstormsecurity.com/files/166745/Asterisk-Project-Security-Advisory-AST-2022-002.html - Patch, Third Party Advisory, VDB Entry | |
CWE | CWE-918 | |
CPE | cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : 6.4
v3 : 9.1 |
First Time |
Digium
Digium asterisk |
15 Apr 2022, 18:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
15 Apr 2022, 05:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-04-15 05:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-26499
Mitre link : CVE-2022-26499
CVE.ORG link : CVE-2022-26499
JSON object : View
Products Affected
debian
- debian_linux
digium
- asterisk
CWE
CWE-918
Server-Side Request Forgery (SSRF)