Search criteria
43 vulnerabilities found for Certified Asterisk by Asterisk
VAR-202112-2083
Vulnerability from variot - Updated: 2025-11-18 14:43PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds. PJSIP Exists in an integer underflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. ========================================================================== Ubuntu Security Notice USN-6422-2 October 24, 2023
ring vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
Summary:
Several security issues were fixed in Ring.
Software Description: - ring: Secure and distributed voice, video, and chat platform
Details:
It was discovered that Ring incorrectly handled certain inputs. (CVE-2021-37706)
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-27585)
Original advisory details:
It was discovered that Ring incorrectly handled certain inputs. (CVE-2021-37706)
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302, CVE-2021-43303, CVE-2021-43804, CVE-2021-43845, CVE-2022-21723, CVE-2022-23537, CVE-2022-23547, CVE-2022-23608, CVE-2022-24754, CVE-2022-24763, CVE-2022-24764, CVE-2022-24793, CVE-2022-31031, CVE-2022-39244)
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-21722)
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-27585)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 23.10: jami 20230206.0~ds2-1.3ubuntu0.1 jami-daemon 20230206.0~ds2-1.3ubuntu0.1
In general, a standard system update will make all the necessary changes.
References: https://ubuntu.com/security/notices/USN-6422-2 https://ubuntu.com/security/notices/USN-6422-1 CVE-2021-37706, CVE-2023-27585
Package Information: https://launchpad.net/ubuntu/+source/ring/20230206.0~ds2-1.3ubuntu0.1
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202210-37
https://security.gentoo.org/
Severity: Normal Title: PJSIP: Multiple Vulnerabilities Date: October 31, 2022 Bugs: #803614, #829894, #875863 ID: 202210-37
Synopsis
Multiple vulnerabilities have been found in PJSIP, the worst of which could result in arbitrary code execution.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/pjproject < 2.12.1 >= 2.12.1
Description
Multiple vulnerabilities have been discovered in PJSIP. Please review the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Resolution
All PJSIP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/pjproject-2.12.1"
References
[ 1 ] CVE-2021-32686 https://nvd.nist.gov/vuln/detail/CVE-2021-32686 [ 2 ] CVE-2021-37706 https://nvd.nist.gov/vuln/detail/CVE-2021-37706 [ 3 ] CVE-2021-41141 https://nvd.nist.gov/vuln/detail/CVE-2021-41141 [ 4 ] CVE-2021-43804 https://nvd.nist.gov/vuln/detail/CVE-2021-43804 [ 5 ] CVE-2021-43845 https://nvd.nist.gov/vuln/detail/CVE-2021-43845 [ 6 ] CVE-2022-21722 https://nvd.nist.gov/vuln/detail/CVE-2022-21722 [ 7 ] CVE-2022-21723 https://nvd.nist.gov/vuln/detail/CVE-2022-21723 [ 8 ] CVE-2022-23608 https://nvd.nist.gov/vuln/detail/CVE-2022-23608 [ 9 ] CVE-2022-24754 https://nvd.nist.gov/vuln/detail/CVE-2022-24754 [ 10 ] CVE-2022-24763 https://nvd.nist.gov/vuln/detail/CVE-2022-24763 [ 11 ] CVE-2022-24764 https://nvd.nist.gov/vuln/detail/CVE-2022-24764 [ 12 ] CVE-2022-24786 https://nvd.nist.gov/vuln/detail/CVE-2022-24786 [ 13 ] CVE-2022-24792 https://nvd.nist.gov/vuln/detail/CVE-2022-24792 [ 14 ] CVE-2022-24793 https://nvd.nist.gov/vuln/detail/CVE-2022-24793 [ 15 ] CVE-2022-31031 https://nvd.nist.gov/vuln/detail/CVE-2022-31031 [ 16 ] CVE-2022-39244 https://nvd.nist.gov/vuln/detail/CVE-2022-39244 [ 17 ] CVE-2022-39269 https://nvd.nist.gov/vuln/detail/CVE-2022-39269
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202210-37
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Debian Security Advisory DSA-5285-1 security@debian.org https://www.debian.org/security/ Markus Koschany November 17, 2022 https://www.debian.org/security/faq
Package : asterisk CVE ID : CVE-2021-37706 CVE-2021-43299 CVE-2021-43300 CVE-2021-43301 CVE-2021-43302 CVE-2021-43303 CVE-2021-43804 CVE-2021-43845 CVE-2021-46837 CVE-2022-21722 CVE-2022-21723 CVE-2022-23608 CVE-2022-24763 CVE-2022-24764 CVE-2022-24786 CVE-2022-24792 CVE-2022-24793 CVE-2022-26498 CVE-2022-26499 CVE-2022-26651 Debian Bug : 1014998 1018073 1014976
Multiple security vulnerabilities have been found in Asterisk, an Open Source Private Branch Exchange. Buffer overflows and other programming errors could be exploited for information disclosure or the execution of arbitrary code.
Special care should be taken when upgrading to this new upstream release. Some configuration files and options have changed in order to remedy certain security vulnerabilities. Most notably the pjsip TLS listener only accepts TLSv1.3 connections in the default configuration now. This can be reverted by adding method=tlsv1_2 to the transport in pjsip.conf. See also https://issues.asterisk.org/jira/browse/ASTERISK-29017.
For the stable distribution (bullseye), these problems have been fixed in version 1:16.28.0~dfsg-0+deb11u1.
We recommend that you upgrade your asterisk packages.
For the detailed security status of asterisk please refer to its security tracker page at: https://security-tracker.debian.org/tracker/asterisk
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmN2qoFfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeR0pQ/+Kr+FWFeFyrkFTyVv5BGBJug+EvZzzC2JZoI/TNsiAWQi/BZTQJ0pmdZr EHokqN7Z35EqZW6sj5aypdK7bOv4N+uv6P59xROk1KjEEG6XttGJ2BUvffWYWEXo k6+ou/yfAxU72Ufd1eOcMtjyGeN0CljmemIJ5Cywpnaw8YArP+VzRK2NEth0gCmJ TAfSvIPFaS7jB6fEg8KESOpmvtlqEJUh5sjP2t+OOEc3AoNBBuj4ZC44SQ1nif6k jEbmLFnJYQF8dP+IasZ3SY80N+BeuGiylZQ6w1ZvuYuUAK3jhHQ3CJvTQ4sEqNQV Zva6t0kHOEKVxKg412oEpQ0ihR+EBF/lnECu7iR2HTKk8xteNwio5qeeW/joTAJx OTYlHTtERTZIiaHdmV3nmGYgrTLeDHClilCnJrQuyXF+LVHjxBWDh7WS83zSrdIH gNP0eZ5UEjrpomf1yKqHVUsji63eSWACdFVXJLACMwpuevq8qgV6zASD+VuUd36r foEOKVj+FIHehWSef9pP48Na8bOn0EDVqtZEPOjE6o8Y8PjgSf7BSNogppZncldw VREox9NsxGM9hSVh3lVBWL8lT76HQVzXjfXXXoIEFDiGokNRV/dNTuhhb/mh0zxr VTKBboC6ijQVCdVQ7UdGFnoVXOWW2gy8sdam40ELBUCGDD5XI7A\xeajm -----END PGP SIGNATURE----- . Asterisk Project Security Advisory - AST-2022-004
Product Asterisk
Summary pjproject: possible integer underflow on STUN
message
Nature of Advisory Arbitrary code execution
Susceptibility Remote unauthenticated sessions
Severity Major
Exploits Known Yes
Reported On March 3, 2022
Reported By Sauw Ming
Posted On March 4, 2022
Last Updated On March 3, 2022
Advisory Contact kharwell AT sangoma DOT com
CVE Name CVE-2021-37706
Description The header length on incoming STUN messages that
contain an ERROR-CODE attribute is not properly
checked. This can result in an integer underflow.
Note, this requires ICE or WebRTC support to be in use
with a malicious remote party.
Modules Affected bundled pjproject
Resolution If you use “with-pjproject-bundled” then upgrade to, or
install one of, the versions of Asterisk listed below.
Otherwise install the appropriate version of pjproject that
contains the patch.
Affected Versions
Product Release Series
Asterisk Open Source 16.x All versions
Asterisk Open Source 18.x All versions
Asterisk Open Source 19.x All versions
Certified Asterisk 16.x All versions
Corrected In
Product Release
Asterisk Open Source 16.24.1,18.10.1,19.2.1
Certified Asterisk 16.8-cert13
Patches
Patch URL Revision
https://downloads.digium.com/pub/security/AST-2022-004-16.diff Asterisk
16
https://downloads.digium.com/pub/security/AST-2022-004-18.diff Asterisk
18
https://downloads.digium.com/pub/security/AST-2022-004-19.diff Asterisk
19
https://downloads.digium.com/pub/security/AST-2022-004-16.8.diff Certified
Asterisk
16.8
Links https://issues.asterisk.org/jira/browse/ASTERISK-29945
https://downloads.asterisk.org/pub/security/AST-2022-004.html
https://github.com/pjsip/pjproject/security/advisories/GHSA-2qpg-f6wf-w984
Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest
version will be posted at
https://downloads.digium.com/pub/security/AST-2022-004.pdf and
https://downloads.digium.com/pub/security/AST-2022-004.html
Revision History
Date Editor Revisions Made
March 3, 2022 Kevin Harwell Initial revision
Asterisk Project Security Advisory - AST-2022-004
Copyright © 2022 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its original, unaltered form
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202112-2083",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "16.24.1"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "18.0.0"
},
{
"model": "pjsip",
"scope": "lte",
"trust": 1.0,
"vendor": "teluu",
"version": "2.11.1"
},
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "18.10.1"
},
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "19.2.1"
},
{
"model": "certified asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "asterisk",
"version": "16.8.0"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "19.0.0"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "16.0.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "10.0"
},
{
"model": "certified asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "16.8.0"
},
{
"model": "gnu/linux",
"scope": null,
"trust": 0.8,
"vendor": "debian",
"version": null
},
{
"model": "asterisk",
"scope": null,
"trust": 0.8,
"vendor": "sangoma",
"version": null
},
{
"model": "certified asterisk",
"scope": null,
"trust": 0.8,
"vendor": "asterisk",
"version": null
},
{
"model": "pjsip",
"scope": null,
"trust": 0.8,
"vendor": "teluu",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-016401"
},
{
"db": "NVD",
"id": "CVE-2021-37706"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ubuntu",
"sources": [
{
"db": "PACKETSTORM",
"id": "175315"
},
{
"db": "PACKETSTORM",
"id": "175025"
}
],
"trust": 0.2
},
"cve": "CVE-2021-37706",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2021-37706",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2021-37706",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "security-advisories@github.com",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2021-37706",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2021-37706",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2021-37706",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "security-advisories@github.com",
"id": "CVE-2021-37706",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2021-37706",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-202112-2179",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2021-37706",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2021-37706"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-2179"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-016401"
},
{
"db": "NVD",
"id": "CVE-2021-37706"
},
{
"db": "NVD",
"id": "CVE-2021-37706"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim\u2019s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim\u2019s machine. Users are advised to upgrade as soon as possible. There are no known workarounds. PJSIP Exists in an integer underflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. ==========================================================================\nUbuntu Security Notice USN-6422-2\nOctober 24, 2023\n\nring vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 23.10\n\nSummary:\n\nSeveral security issues were fixed in Ring. \n\nSoftware Description:\n- ring: Secure and distributed voice, video, and chat platform\n\nDetails:\n\nIt was discovered that Ring incorrectly handled certain inputs. \n(CVE-2021-37706)\n\nIt was discovered that Ring incorrectly handled certain inputs. If a user or\nan automated system were tricked into opening a specially crafted input file,\na remote attacker could possibly use this issue to cause a denial of service. \n(CVE-2023-27585)\n\n\nOriginal advisory details:\n\n\n It was discovered that Ring incorrectly handled certain inputs. \n (CVE-2021-37706)\n\n It was discovered that Ring incorrectly handled certain inputs. If a user or\n an automated system were tricked into opening a specially crafted input file,\n a remote attacker could possibly use this issue to cause a denial of service. \n This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. \n (CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302,\n CVE-2021-43303, CVE-2021-43804, CVE-2021-43845, CVE-2022-21723,\n CVE-2022-23537, CVE-2022-23547, CVE-2022-23608, CVE-2022-24754,\n CVE-2022-24763, CVE-2022-24764, CVE-2022-24793, CVE-2022-31031,\n CVE-2022-39244)\n\n It was discovered that Ring incorrectly handled certain inputs. If a user or\n an automated system were tricked into opening a specially crafted input file,\n a remote attacker could possibly use this issue to cause a denial of service. \n This issue only affected Ubuntu 20.04 LTS. (CVE-2022-21722)\n\n It was discovered that Ring incorrectly handled certain inputs. If a user or\n an automated system were tricked into opening a specially crafted input file,\n a remote attacker could possibly use this issue to cause a denial of service. \n (CVE-2023-27585)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 23.10:\n jami 20230206.0~ds2-1.3ubuntu0.1\n jami-daemon 20230206.0~ds2-1.3ubuntu0.1\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n https://ubuntu.com/security/notices/USN-6422-2\n https://ubuntu.com/security/notices/USN-6422-1\n CVE-2021-37706, CVE-2023-27585\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/ring/20230206.0~ds2-1.3ubuntu0.1\n\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 202210-37\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: PJSIP: Multiple Vulnerabilities\n Date: October 31, 2022\n Bugs: #803614, #829894, #875863\n ID: 202210-37\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n=======\nMultiple vulnerabilities have been found in PJSIP, the worst of which\ncould result in arbitrary code execution. \n\nAffected packages\n================\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 net-libs/pjproject \u003c 2.12.1 \u003e= 2.12.1\n\nDescription\n==========\nMultiple vulnerabilities have been discovered in PJSIP. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n=====\nPlease review the referenced CVE identifiers for details. \n\nResolution\n=========\nAll PJSIP users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-libs/pjproject-2.12.1\"\n\nReferences\n=========\n[ 1 ] CVE-2021-32686\n https://nvd.nist.gov/vuln/detail/CVE-2021-32686\n[ 2 ] CVE-2021-37706\n https://nvd.nist.gov/vuln/detail/CVE-2021-37706\n[ 3 ] CVE-2021-41141\n https://nvd.nist.gov/vuln/detail/CVE-2021-41141\n[ 4 ] CVE-2021-43804\n https://nvd.nist.gov/vuln/detail/CVE-2021-43804\n[ 5 ] CVE-2021-43845\n https://nvd.nist.gov/vuln/detail/CVE-2021-43845\n[ 6 ] CVE-2022-21722\n https://nvd.nist.gov/vuln/detail/CVE-2022-21722\n[ 7 ] CVE-2022-21723\n https://nvd.nist.gov/vuln/detail/CVE-2022-21723\n[ 8 ] CVE-2022-23608\n https://nvd.nist.gov/vuln/detail/CVE-2022-23608\n[ 9 ] CVE-2022-24754\n https://nvd.nist.gov/vuln/detail/CVE-2022-24754\n[ 10 ] CVE-2022-24763\n https://nvd.nist.gov/vuln/detail/CVE-2022-24763\n[ 11 ] CVE-2022-24764\n https://nvd.nist.gov/vuln/detail/CVE-2022-24764\n[ 12 ] CVE-2022-24786\n https://nvd.nist.gov/vuln/detail/CVE-2022-24786\n[ 13 ] CVE-2022-24792\n https://nvd.nist.gov/vuln/detail/CVE-2022-24792\n[ 14 ] CVE-2022-24793\n https://nvd.nist.gov/vuln/detail/CVE-2022-24793\n[ 15 ] CVE-2022-31031\n https://nvd.nist.gov/vuln/detail/CVE-2022-31031\n[ 16 ] CVE-2022-39244\n https://nvd.nist.gov/vuln/detail/CVE-2022-39244\n[ 17 ] CVE-2022-39269\n https://nvd.nist.gov/vuln/detail/CVE-2022-39269\n\nAvailability\n===========\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202210-37\n\nConcerns?\n========\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n======\nCopyright 2022 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-5285-1 security@debian.org\nhttps://www.debian.org/security/ Markus Koschany\nNovember 17, 2022 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : asterisk\nCVE ID : CVE-2021-37706 CVE-2021-43299 CVE-2021-43300 CVE-2021-43301\n CVE-2021-43302 CVE-2021-43303 CVE-2021-43804 CVE-2021-43845\n CVE-2021-46837 CVE-2022-21722 CVE-2022-21723 CVE-2022-23608\n CVE-2022-24763 CVE-2022-24764 CVE-2022-24786 CVE-2022-24792\n CVE-2022-24793 CVE-2022-26498 CVE-2022-26499 CVE-2022-26651\nDebian Bug : 1014998 1018073 1014976\n\nMultiple security vulnerabilities have been found in Asterisk, an Open Source\nPrivate Branch Exchange. Buffer overflows and other programming errors could be\nexploited for information disclosure or the execution of arbitrary code. \n\nSpecial care should be taken when upgrading to this new upstream release. \nSome configuration files and options have changed in order to remedy\ncertain security vulnerabilities. Most notably the pjsip TLS listener only\naccepts TLSv1.3 connections in the default configuration now. This can be\nreverted by adding method=tlsv1_2 to the transport in pjsip.conf. See also\nhttps://issues.asterisk.org/jira/browse/ASTERISK-29017. \n\nFor the stable distribution (bullseye), these problems have been fixed in\nversion 1:16.28.0~dfsg-0+deb11u1. \n\nWe recommend that you upgrade your asterisk packages. \n\nFor the detailed security status of asterisk please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/asterisk\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmN2qoFfFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD\nRjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7\nUeR0pQ/+Kr+FWFeFyrkFTyVv5BGBJug+EvZzzC2JZoI/TNsiAWQi/BZTQJ0pmdZr\nEHokqN7Z35EqZW6sj5aypdK7bOv4N+uv6P59xROk1KjEEG6XttGJ2BUvffWYWEXo\nk6+ou/yfAxU72Ufd1eOcMtjyGeN0CljmemIJ5Cywpnaw8YArP+VzRK2NEth0gCmJ\nTAfSvIPFaS7jB6fEg8KESOpmvtlqEJUh5sjP2t+OOEc3AoNBBuj4ZC44SQ1nif6k\njEbmLFnJYQF8dP+IasZ3SY80N+BeuGiylZQ6w1ZvuYuUAK3jhHQ3CJvTQ4sEqNQV\nZva6t0kHOEKVxKg412oEpQ0ihR+EBF/lnECu7iR2HTKk8xteNwio5qeeW/joTAJx\nOTYlHTtERTZIiaHdmV3nmGYgrTLeDHClilCnJrQuyXF+LVHjxBWDh7WS83zSrdIH\ngNP0eZ5UEjrpomf1yKqHVUsji63eSWACdFVXJLACMwpuevq8qgV6zASD+VuUd36r\nfoEOKVj+FIHehWSef9pP48Na8bOn0EDVqtZEPOjE6o8Y8PjgSf7BSNogppZncldw\nVREox9NsxGM9hSVh3lVBWL8lT76HQVzXjfXXXoIEFDiGokNRV/dNTuhhb/mh0zxr\nVTKBboC6ijQVCdVQ7UdGFnoVXOWW2gy8sdam40ELBUCGDD5XI7A\\xeajm\n-----END PGP SIGNATURE-----\n. Asterisk Project Security Advisory - AST-2022-004\n\n Product Asterisk \n Summary pjproject: possible integer underflow on STUN \n message \n Nature of Advisory Arbitrary code execution \n Susceptibility Remote unauthenticated sessions \n Severity Major \n Exploits Known Yes \n Reported On March 3, 2022 \n Reported By Sauw Ming \n Posted On March 4, 2022 \n Last Updated On March 3, 2022 \n Advisory Contact kharwell AT sangoma DOT com \n CVE Name CVE-2021-37706 \n\n Description The header length on incoming STUN messages that \n contain an ERROR-CODE attribute is not properly \n checked. This can result in an integer underflow. \n Note, this requires ICE or WebRTC support to be in use \n with a malicious remote party. \n Modules Affected bundled pjproject \n\n Resolution If you use \u201cwith-pjproject-bundled\u201d then upgrade to, or \n install one of, the versions of Asterisk listed below. \n Otherwise install the appropriate version of pjproject that \n contains the patch. \n\n Affected Versions\n Product Release Series \n Asterisk Open Source 16.x All versions \n Asterisk Open Source 18.x All versions \n Asterisk Open Source 19.x All versions \n Certified Asterisk 16.x All versions \n\n Corrected In\n Product Release \n Asterisk Open Source 16.24.1,18.10.1,19.2.1 \n Certified Asterisk 16.8-cert13 \n\n Patches \n Patch URL Revision \n https://downloads.digium.com/pub/security/AST-2022-004-16.diff Asterisk \n 16 \n https://downloads.digium.com/pub/security/AST-2022-004-18.diff Asterisk \n 18 \n https://downloads.digium.com/pub/security/AST-2022-004-19.diff Asterisk \n 19 \n https://downloads.digium.com/pub/security/AST-2022-004-16.8.diff Certified \n Asterisk \n 16.8 \n\nLinks https://issues.asterisk.org/jira/browse/ASTERISK-29945 \n \n https://downloads.asterisk.org/pub/security/AST-2022-004.html \n \n https://github.com/pjsip/pjproject/security/advisories/GHSA-2qpg-f6wf-w984 \n\n Asterisk Project Security Advisories are posted at \n http://www.asterisk.org/security \n \n This document may be superseded by later versions; if so, the latest \n version will be posted at \n https://downloads.digium.com/pub/security/AST-2022-004.pdf and \n https://downloads.digium.com/pub/security/AST-2022-004.html \n\n Revision History\n Date Editor Revisions Made \n March 3, 2022 Kevin Harwell Initial revision \n\n Asterisk Project Security Advisory - AST-2022-004\n Copyright \u00a9 2022 Digium, Inc. All Rights Reserved. \n Permission is hereby granted to distribute and publish this advisory in its\n original, unaltered form",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-37706"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-016401"
},
{
"db": "VULMON",
"id": "CVE-2021-37706"
},
{
"db": "PACKETSTORM",
"id": "175315"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "175025"
},
{
"db": "PACKETSTORM",
"id": "166225"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-37706",
"trust": 3.8
},
{
"db": "PACKETSTORM",
"id": "166225",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-016401",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "169618",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "169938",
"trust": 0.7
},
{
"db": "CS-HELP",
"id": "SB2022022414",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022030601",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0941",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202112-2179",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-37706",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "175315",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "175025",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2021-37706"
},
{
"db": "PACKETSTORM",
"id": "175315"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "175025"
},
{
"db": "PACKETSTORM",
"id": "166225"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-2179"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-016401"
},
{
"db": "NVD",
"id": "CVE-2021-37706"
}
]
},
"id": "VAR-202112-2083",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.348297215
},
"last_update_date": "2025-11-18T14:43:44.980000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Potential\u00a0integer\u00a0underflow\u00a0upon\u00a0receiving\u00a0STUN\u00a0message",
"trust": 0.8,
"url": "https://www.asterisk.org/"
},
{
"title": "PJSIP Fixes for digital error vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=176822"
},
{
"title": "Debian CVElist Bug Report Logs: ring: CVE-2021-32686 CVE-2021-37706 CVE-2022-21723 CVE-2022-23608 CVE-2021-43299 CVE-2021-43300 CVE-2021-43301 CVE-2021-43302 CVE-2021-43303 CVE-2021-43804 CVE-2021-43845 CVE-2022-21722 CVE-2022-24754 CVE-2022-24763 CVE-2022-24764 CVE-2022-24793",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=4e89fc7b47aa12e94340b2e2db73b906"
},
{
"title": "Debian Security Advisories: DSA-5285-1 asterisk -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=edc2cf0db8c0593c65c4c82227026727"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2021-37706"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-2179"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-016401"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-191",
"trust": 1.0
},
{
"problemtype": "Integer underflow (CWE-191) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-016401"
},
{
"db": "NVD",
"id": "CVE-2021-37706"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://seclists.org/fulldisclosure/2022/mar/0"
},
{
"trust": 2.3,
"url": "http://packetstormsecurity.com/files/166225/asterisk-project-security-advisory-ast-2022-004.html"
},
{
"trust": 1.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-37706"
},
{
"trust": 1.8,
"url": "https://github.com/pjsip/pjproject/security/advisories/ghsa-2qpg-f6wf-w984"
},
{
"trust": 1.8,
"url": "https://security.gentoo.org/glsa/202210-37"
},
{
"trust": 1.8,
"url": "https://www.debian.org/security/2022/dsa-5285"
},
{
"trust": 1.7,
"url": "https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865"
},
{
"trust": 1.7,
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html"
},
{
"trust": 1.7,
"url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"
},
{
"trust": 1.0,
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html"
},
{
"trust": 1.0,
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/169618/gentoo-linux-security-advisory-202210-37.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/169938/debian-security-advisory-5285-1.html"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022022414"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022030601"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/asterisk-integer-overflow-via-pjproject-stun-message-37712"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0941"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21722"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24763"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43303"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-39244"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43804"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23608"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24764"
},
{
"trust": 0.2,
"url": "https://ubuntu.com/security/notices/usn-6422-1"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23537"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-27585"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24793"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43845"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21723"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43302"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/191.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014998"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/ring/20230206.0~ds2-1.3ubuntu0.1"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-6422-2"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-41141"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24754"
},
{
"trust": 0.1,
"url": "https://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-39269"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24786"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24792"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-31031"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-32686"
},
{
"trust": 0.1,
"url": "https://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43299"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-46837"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43301"
},
{
"trust": 0.1,
"url": "https://issues.asterisk.org/jira/browse/asterisk-29017."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43300"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/asterisk"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/ring/20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/ring/20230206.0~ds1-5ubuntu0.1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23547"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-004-16.diff"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-004.pdf"
},
{
"trust": 0.1,
"url": "http://www.asterisk.org/security"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-004-18.diff"
},
{
"trust": 0.1,
"url": "https://downloads.asterisk.org/pub/security/ast-2022-004.html"
},
{
"trust": 0.1,
"url": "https://issues.asterisk.org/jira/browse/asterisk-29945"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-004.html"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-004-19.diff"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-004-16.8.diff"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2021-37706"
},
{
"db": "PACKETSTORM",
"id": "175315"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "175025"
},
{
"db": "PACKETSTORM",
"id": "166225"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-2179"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-016401"
},
{
"db": "NVD",
"id": "CVE-2021-37706"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2021-37706"
},
{
"db": "PACKETSTORM",
"id": "175315"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "175025"
},
{
"db": "PACKETSTORM",
"id": "166225"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-2179"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-016401"
},
{
"db": "NVD",
"id": "CVE-2021-37706"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-12-22T00:00:00",
"db": "VULMON",
"id": "CVE-2021-37706"
},
{
"date": "2023-10-24T16:01:47",
"db": "PACKETSTORM",
"id": "175315"
},
{
"date": "2022-11-01T13:21:55",
"db": "PACKETSTORM",
"id": "169618"
},
{
"date": "2022-11-18T14:28:10",
"db": "PACKETSTORM",
"id": "169938"
},
{
"date": "2023-10-10T14:47:37",
"db": "PACKETSTORM",
"id": "175025"
},
{
"date": "2022-03-07T16:25:13",
"db": "PACKETSTORM",
"id": "166225"
},
{
"date": "2021-12-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202112-2179"
},
{
"date": "2022-12-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-016401"
},
{
"date": "2021-12-22T18:15:07.487000",
"db": "NVD",
"id": "CVE-2021-37706"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-11-18T00:00:00",
"db": "VULMON",
"id": "CVE-2021-37706"
},
{
"date": "2022-11-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202112-2179"
},
{
"date": "2022-12-14T05:31:00",
"db": "JVNDB",
"id": "JVNDB-2021-016401"
},
{
"date": "2025-11-04T16:15:43.010000",
"db": "NVD",
"id": "CVE-2021-37706"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "175315"
},
{
"db": "PACKETSTORM",
"id": "175025"
},
{
"db": "PACKETSTORM",
"id": "166225"
},
{
"db": "CNNVD",
"id": "CNNVD-202112-2179"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "PJSIP\u00a0 Integer Underflow Vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-016401"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "digital error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202112-2179"
}
],
"trust": 0.6
}
}
VAR-202201-0582
Vulnerability from variot - Updated: 2025-11-18 13:57PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the master branch. There are no known workarounds. PJSIP Exists in an out-of-bounds read vulnerability.Information is obtained and service operation is interrupted (DoS) It may be in a state. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202210-37
https://security.gentoo.org/
Severity: Normal Title: PJSIP: Multiple Vulnerabilities Date: October 31, 2022 Bugs: #803614, #829894, #875863 ID: 202210-37
Synopsis
Multiple vulnerabilities have been found in PJSIP, the worst of which could result in arbitrary code execution.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/pjproject < 2.12.1 >= 2.12.1
Description
Multiple vulnerabilities have been discovered in PJSIP. Please review the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Resolution
All PJSIP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/pjproject-2.12.1"
References
[ 1 ] CVE-2021-32686 https://nvd.nist.gov/vuln/detail/CVE-2021-32686 [ 2 ] CVE-2021-37706 https://nvd.nist.gov/vuln/detail/CVE-2021-37706 [ 3 ] CVE-2021-41141 https://nvd.nist.gov/vuln/detail/CVE-2021-41141 [ 4 ] CVE-2021-43804 https://nvd.nist.gov/vuln/detail/CVE-2021-43804 [ 5 ] CVE-2021-43845 https://nvd.nist.gov/vuln/detail/CVE-2021-43845 [ 6 ] CVE-2022-21722 https://nvd.nist.gov/vuln/detail/CVE-2022-21722 [ 7 ] CVE-2022-21723 https://nvd.nist.gov/vuln/detail/CVE-2022-21723 [ 8 ] CVE-2022-23608 https://nvd.nist.gov/vuln/detail/CVE-2022-23608 [ 9 ] CVE-2022-24754 https://nvd.nist.gov/vuln/detail/CVE-2022-24754 [ 10 ] CVE-2022-24763 https://nvd.nist.gov/vuln/detail/CVE-2022-24763 [ 11 ] CVE-2022-24764 https://nvd.nist.gov/vuln/detail/CVE-2022-24764 [ 12 ] CVE-2022-24786 https://nvd.nist.gov/vuln/detail/CVE-2022-24786 [ 13 ] CVE-2022-24792 https://nvd.nist.gov/vuln/detail/CVE-2022-24792 [ 14 ] CVE-2022-24793 https://nvd.nist.gov/vuln/detail/CVE-2022-24793 [ 15 ] CVE-2022-31031 https://nvd.nist.gov/vuln/detail/CVE-2022-31031 [ 16 ] CVE-2022-39244 https://nvd.nist.gov/vuln/detail/CVE-2022-39244 [ 17 ] CVE-2022-39269 https://nvd.nist.gov/vuln/detail/CVE-2022-39269
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202210-37
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Debian Security Advisory DSA-5285-1 security@debian.org https://www.debian.org/security/ Markus Koschany November 17, 2022 https://www.debian.org/security/faq
Package : asterisk CVE ID : CVE-2021-37706 CVE-2021-43299 CVE-2021-43300 CVE-2021-43301 CVE-2021-43302 CVE-2021-43303 CVE-2021-43804 CVE-2021-43845 CVE-2021-46837 CVE-2022-21722 CVE-2022-21723 CVE-2022-23608 CVE-2022-24763 CVE-2022-24764 CVE-2022-24786 CVE-2022-24792 CVE-2022-24793 CVE-2022-26498 CVE-2022-26499 CVE-2022-26651 Debian Bug : 1014998 1018073 1014976
Multiple security vulnerabilities have been found in Asterisk, an Open Source Private Branch Exchange. Buffer overflows and other programming errors could be exploited for information disclosure or the execution of arbitrary code.
Special care should be taken when upgrading to this new upstream release. Some configuration files and options have changed in order to remedy certain security vulnerabilities. Most notably the pjsip TLS listener only accepts TLSv1.3 connections in the default configuration now. This can be reverted by adding method=tlsv1_2 to the transport in pjsip.conf. See also https://issues.asterisk.org/jira/browse/ASTERISK-29017.
For the stable distribution (bullseye), these problems have been fixed in version 1:16.28.0~dfsg-0+deb11u1.
We recommend that you upgrade your asterisk packages.
For the detailed security status of asterisk please refer to its security tracker page at: https://security-tracker.debian.org/tracker/asterisk
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmN2qoFfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeR0pQ/+Kr+FWFeFyrkFTyVv5BGBJug+EvZzzC2JZoI/TNsiAWQi/BZTQJ0pmdZr EHokqN7Z35EqZW6sj5aypdK7bOv4N+uv6P59xROk1KjEEG6XttGJ2BUvffWYWEXo k6+ou/yfAxU72Ufd1eOcMtjyGeN0CljmemIJ5Cywpnaw8YArP+VzRK2NEth0gCmJ TAfSvIPFaS7jB6fEg8KESOpmvtlqEJUh5sjP2t+OOEc3AoNBBuj4ZC44SQ1nif6k jEbmLFnJYQF8dP+IasZ3SY80N+BeuGiylZQ6w1ZvuYuUAK3jhHQ3CJvTQ4sEqNQV Zva6t0kHOEKVxKg412oEpQ0ihR+EBF/lnECu7iR2HTKk8xteNwio5qeeW/joTAJx OTYlHTtERTZIiaHdmV3nmGYgrTLeDHClilCnJrQuyXF+LVHjxBWDh7WS83zSrdIH gNP0eZ5UEjrpomf1yKqHVUsji63eSWACdFVXJLACMwpuevq8qgV6zASD+VuUd36r foEOKVj+FIHehWSef9pP48Na8bOn0EDVqtZEPOjE6o8Y8PjgSf7BSNogppZncldw VREox9NsxGM9hSVh3lVBWL8lT76HQVzXjfXXXoIEFDiGokNRV/dNTuhhb/mh0zxr VTKBboC6ijQVCdVQ7UdGFnoVXOWW2gy8sdam40ELBUCGDD5XI7A\xeajm -----END PGP SIGNATURE----- . Asterisk Project Security Advisory - AST-2022-006
Product Asterisk
Summary pjproject: unconstrained malformed multipart SIP
message
Nature of Advisory Out of bounds memory access
Susceptibility Remote unauthenticated sessions
Severity Minor
Exploits Known Yes
Reported On March 3, 2022
Reported By Sauw Ming
Posted On March 4, 2022
Last Updated On March 3, 2022
Advisory Contact kharwell AT sangoma DOT com
CVE Name CVE-2022-21723
Description If an incoming SIP message contains a malformed
multi-part body an out of bounds read access may
occur, which can result in undefined behavior. Note,
it’s currently uncertain if there is any externally
exploitable vector within Asterisk for this issue, but
providing this as a security issue out of caution.
Modules Affected bundled pjproject
Resolution If you use “with-pjproject-bundled” then upgrade to, or
install one of, the versions of Asterisk listed below.
Otherwise install the appropriate version of pjproject that
contains the patch.
Affected Versions
Product Release Series
Asterisk Open Source 16.x All versions
Asterisk Open Source 18.x All versions
Asterisk Open Source 19.x All versions
Certified Asterisk 16.x All versions
Corrected In
Product Release
Asterisk Open Source 16.24.1,18.10.1,19.2.1
Certified Asterisk 16.8-cert13
Patches
Patch URL Revision
https://downloads.digium.com/pub/security/AST-2022-006-16.diff Asterisk
16
https://downloads.digium.com/pub/security/AST-2022-006-18.diff Asterisk
18
https://downloads.digium.com/pub/security/AST-2022-006-19.diff Asterisk
19
https://downloads.digium.com/pub/security/AST-2022-006-16.8.diff Certified
Asterisk
16.8
Links https://issues.asterisk.org/jira/browse/ASTERISK-29945
https://downloads.asterisk.org/pub/security/AST-2022-006.html
https://github.com/pjsip/pjproject/security/advisories/GHSA-7fw8-54cv-r7pm
Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest
version will be posted at
https://downloads.digium.com/pub/security/AST-2022-006.pdf and
https://downloads.digium.com/pub/security/AST-2022-006.html
Revision History
Date Editor Revisions Made
March 3, 2022 Kevin Harwell Initial revision
Asterisk Project Security Advisory - AST-2022-006
Copyright © 2022 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its original, unaltered form
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202201-0582",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "16.24.1"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "18.0.0"
},
{
"model": "pjsip",
"scope": "lte",
"trust": 1.0,
"vendor": "teluu",
"version": "2.11.1"
},
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "18.10.1"
},
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "19.2.1"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "19.0.0"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "16.0.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "10.0"
},
{
"model": "certified asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "16.8.0"
},
{
"model": "gnu/linux",
"scope": null,
"trust": 0.8,
"vendor": "debian",
"version": null
},
{
"model": "certified asterisk",
"scope": null,
"trust": 0.8,
"vendor": "asterisk",
"version": null
},
{
"model": "pjsip",
"scope": "lte",
"trust": 0.8,
"vendor": "teluu",
"version": "2.11.1 and earlier"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-004350"
},
{
"db": "NVD",
"id": "CVE-2022-21723"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Gentoo",
"sources": [
{
"db": "PACKETSTORM",
"id": "169618"
}
],
"trust": 0.1
},
"cve": "CVE-2022-21723",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2022-21723",
"impactScore": 4.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2022-21723",
"impactScore": 5.2,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 9.1,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2022-004350",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-21723",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "security-advisories@github.com",
"id": "CVE-2022-21723",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2022-21723",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-202201-2496",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2022-21723",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-21723"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-2496"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-004350"
},
{
"db": "NVD",
"id": "CVE-2022-21723"
},
{
"db": "NVD",
"id": "CVE-2022-21723"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds. PJSIP Exists in an out-of-bounds read vulnerability.Information is obtained and service operation is interrupted (DoS) It may be in a state. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 202210-37\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: PJSIP: Multiple Vulnerabilities\n Date: October 31, 2022\n Bugs: #803614, #829894, #875863\n ID: 202210-37\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n=======\nMultiple vulnerabilities have been found in PJSIP, the worst of which\ncould result in arbitrary code execution. \n\nAffected packages\n================\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 net-libs/pjproject \u003c 2.12.1 \u003e= 2.12.1\n\nDescription\n==========\nMultiple vulnerabilities have been discovered in PJSIP. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n=====\nPlease review the referenced CVE identifiers for details. \n\nResolution\n=========\nAll PJSIP users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-libs/pjproject-2.12.1\"\n\nReferences\n=========\n[ 1 ] CVE-2021-32686\n https://nvd.nist.gov/vuln/detail/CVE-2021-32686\n[ 2 ] CVE-2021-37706\n https://nvd.nist.gov/vuln/detail/CVE-2021-37706\n[ 3 ] CVE-2021-41141\n https://nvd.nist.gov/vuln/detail/CVE-2021-41141\n[ 4 ] CVE-2021-43804\n https://nvd.nist.gov/vuln/detail/CVE-2021-43804\n[ 5 ] CVE-2021-43845\n https://nvd.nist.gov/vuln/detail/CVE-2021-43845\n[ 6 ] CVE-2022-21722\n https://nvd.nist.gov/vuln/detail/CVE-2022-21722\n[ 7 ] CVE-2022-21723\n https://nvd.nist.gov/vuln/detail/CVE-2022-21723\n[ 8 ] CVE-2022-23608\n https://nvd.nist.gov/vuln/detail/CVE-2022-23608\n[ 9 ] CVE-2022-24754\n https://nvd.nist.gov/vuln/detail/CVE-2022-24754\n[ 10 ] CVE-2022-24763\n https://nvd.nist.gov/vuln/detail/CVE-2022-24763\n[ 11 ] CVE-2022-24764\n https://nvd.nist.gov/vuln/detail/CVE-2022-24764\n[ 12 ] CVE-2022-24786\n https://nvd.nist.gov/vuln/detail/CVE-2022-24786\n[ 13 ] CVE-2022-24792\n https://nvd.nist.gov/vuln/detail/CVE-2022-24792\n[ 14 ] CVE-2022-24793\n https://nvd.nist.gov/vuln/detail/CVE-2022-24793\n[ 15 ] CVE-2022-31031\n https://nvd.nist.gov/vuln/detail/CVE-2022-31031\n[ 16 ] CVE-2022-39244\n https://nvd.nist.gov/vuln/detail/CVE-2022-39244\n[ 17 ] CVE-2022-39269\n https://nvd.nist.gov/vuln/detail/CVE-2022-39269\n\nAvailability\n===========\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202210-37\n\nConcerns?\n========\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n======\nCopyright 2022 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-5285-1 security@debian.org\nhttps://www.debian.org/security/ Markus Koschany\nNovember 17, 2022 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : asterisk\nCVE ID : CVE-2021-37706 CVE-2021-43299 CVE-2021-43300 CVE-2021-43301\n CVE-2021-43302 CVE-2021-43303 CVE-2021-43804 CVE-2021-43845\n CVE-2021-46837 CVE-2022-21722 CVE-2022-21723 CVE-2022-23608\n CVE-2022-24763 CVE-2022-24764 CVE-2022-24786 CVE-2022-24792\n CVE-2022-24793 CVE-2022-26498 CVE-2022-26499 CVE-2022-26651\nDebian Bug : 1014998 1018073 1014976\n\nMultiple security vulnerabilities have been found in Asterisk, an Open Source\nPrivate Branch Exchange. Buffer overflows and other programming errors could be\nexploited for information disclosure or the execution of arbitrary code. \n\nSpecial care should be taken when upgrading to this new upstream release. \nSome configuration files and options have changed in order to remedy\ncertain security vulnerabilities. Most notably the pjsip TLS listener only\naccepts TLSv1.3 connections in the default configuration now. This can be\nreverted by adding method=tlsv1_2 to the transport in pjsip.conf. See also\nhttps://issues.asterisk.org/jira/browse/ASTERISK-29017. \n\nFor the stable distribution (bullseye), these problems have been fixed in\nversion 1:16.28.0~dfsg-0+deb11u1. \n\nWe recommend that you upgrade your asterisk packages. \n\nFor the detailed security status of asterisk please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/asterisk\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmN2qoFfFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD\nRjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7\nUeR0pQ/+Kr+FWFeFyrkFTyVv5BGBJug+EvZzzC2JZoI/TNsiAWQi/BZTQJ0pmdZr\nEHokqN7Z35EqZW6sj5aypdK7bOv4N+uv6P59xROk1KjEEG6XttGJ2BUvffWYWEXo\nk6+ou/yfAxU72Ufd1eOcMtjyGeN0CljmemIJ5Cywpnaw8YArP+VzRK2NEth0gCmJ\nTAfSvIPFaS7jB6fEg8KESOpmvtlqEJUh5sjP2t+OOEc3AoNBBuj4ZC44SQ1nif6k\njEbmLFnJYQF8dP+IasZ3SY80N+BeuGiylZQ6w1ZvuYuUAK3jhHQ3CJvTQ4sEqNQV\nZva6t0kHOEKVxKg412oEpQ0ihR+EBF/lnECu7iR2HTKk8xteNwio5qeeW/joTAJx\nOTYlHTtERTZIiaHdmV3nmGYgrTLeDHClilCnJrQuyXF+LVHjxBWDh7WS83zSrdIH\ngNP0eZ5UEjrpomf1yKqHVUsji63eSWACdFVXJLACMwpuevq8qgV6zASD+VuUd36r\nfoEOKVj+FIHehWSef9pP48Na8bOn0EDVqtZEPOjE6o8Y8PjgSf7BSNogppZncldw\nVREox9NsxGM9hSVh3lVBWL8lT76HQVzXjfXXXoIEFDiGokNRV/dNTuhhb/mh0zxr\nVTKBboC6ijQVCdVQ7UdGFnoVXOWW2gy8sdam40ELBUCGDD5XI7A\\xeajm\n-----END PGP SIGNATURE-----\n. Asterisk Project Security Advisory - AST-2022-006\n\n Product Asterisk \n Summary pjproject: unconstrained malformed multipart SIP \n message \n Nature of Advisory Out of bounds memory access \n Susceptibility Remote unauthenticated sessions \n Severity Minor \n Exploits Known Yes \n Reported On March 3, 2022 \n Reported By Sauw Ming \n Posted On March 4, 2022 \n Last Updated On March 3, 2022 \n Advisory Contact kharwell AT sangoma DOT com \n CVE Name CVE-2022-21723 \n\n Description If an incoming SIP message contains a malformed \n multi-part body an out of bounds read access may \n occur, which can result in undefined behavior. Note, \n it\u2019s currently uncertain if there is any externally \n exploitable vector within Asterisk for this issue, but \n providing this as a security issue out of caution. \n Modules Affected bundled pjproject \n\n Resolution If you use \u201cwith-pjproject-bundled\u201d then upgrade to, or \n install one of, the versions of Asterisk listed below. \n Otherwise install the appropriate version of pjproject that \n contains the patch. \n\n Affected Versions\n Product Release Series \n Asterisk Open Source 16.x All versions \n Asterisk Open Source 18.x All versions \n Asterisk Open Source 19.x All versions \n Certified Asterisk 16.x All versions \n\n Corrected In\n Product Release \n Asterisk Open Source 16.24.1,18.10.1,19.2.1 \n Certified Asterisk 16.8-cert13 \n\n Patches \n Patch URL Revision \n https://downloads.digium.com/pub/security/AST-2022-006-16.diff Asterisk \n 16 \n https://downloads.digium.com/pub/security/AST-2022-006-18.diff Asterisk \n 18 \n https://downloads.digium.com/pub/security/AST-2022-006-19.diff Asterisk \n 19 \n https://downloads.digium.com/pub/security/AST-2022-006-16.8.diff Certified \n Asterisk \n 16.8 \n\nLinks https://issues.asterisk.org/jira/browse/ASTERISK-29945 \n \n https://downloads.asterisk.org/pub/security/AST-2022-006.html \n \n https://github.com/pjsip/pjproject/security/advisories/GHSA-7fw8-54cv-r7pm \n\n Asterisk Project Security Advisories are posted at \n http://www.asterisk.org/security \n \n This document may be superseded by later versions; if so, the latest \n version will be posted at \n https://downloads.digium.com/pub/security/AST-2022-006.pdf and \n https://downloads.digium.com/pub/security/AST-2022-006.html \n\n Revision History\n Date Editor Revisions Made \n March 3, 2022 Kevin Harwell Initial revision \n\n Asterisk Project Security Advisory - AST-2022-006\n Copyright \u00a9 2022 Digium, Inc. All Rights Reserved. \n Permission is hereby granted to distribute and publish this advisory in its\n original, unaltered form",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-21723"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-004350"
},
{
"db": "VULMON",
"id": "CVE-2022-21723"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "166227"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-21723",
"trust": 3.6
},
{
"db": "PACKETSTORM",
"id": "166227",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-004350",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "169618",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "169938",
"trust": 0.7
},
{
"db": "CS-HELP",
"id": "SB2022022414",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022030601",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0943",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202201-2496",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-21723",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-21723"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "166227"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-2496"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-004350"
},
{
"db": "NVD",
"id": "CVE-2022-21723"
}
]
},
"id": "VAR-202201-0582",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.348297215
},
"last_update_date": "2025-11-18T13:57:30.498000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Merge\u00a0pull\u00a0request\u00a0from\u00a0GHSA-7fw8-54cv-r7pm GitHub",
"trust": 0.8,
"url": "https://www.asterisk.org/products/software/certified-asterisk/"
},
{
"title": "PJSIP Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=179686"
},
{
"title": "Debian CVElist Bug Report Logs: ring: CVE-2021-32686 CVE-2021-37706 CVE-2022-21723 CVE-2022-23608 CVE-2021-43299 CVE-2021-43300 CVE-2021-43301 CVE-2021-43302 CVE-2021-43303 CVE-2021-43804 CVE-2021-43845 CVE-2022-21722 CVE-2022-24754 CVE-2022-24763 CVE-2022-24764 CVE-2022-24793",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=4e89fc7b47aa12e94340b2e2db73b906"
},
{
"title": "Debian Security Advisories: DSA-5285-1 asterisk -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=edc2cf0db8c0593c65c4c82227026727"
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/AlphabugX/CVE-2022-23305 "
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/AlphabugX/CVE-2022-RCE "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-21723"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-2496"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-004350"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-125",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds read (CWE-125) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-004350"
},
{
"db": "NVD",
"id": "CVE-2022-21723"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://seclists.org/fulldisclosure/2022/mar/2"
},
{
"trust": 2.3,
"url": "http://packetstormsecurity.com/files/166227/asterisk-project-security-advisory-ast-2022-006.html"
},
{
"trust": 1.8,
"url": "https://github.com/pjsip/pjproject/security/advisories/ghsa-7fw8-54cv-r7pm"
},
{
"trust": 1.8,
"url": "https://security.gentoo.org/glsa/202210-37"
},
{
"trust": 1.8,
"url": "https://www.debian.org/security/2022/dsa-5285"
},
{
"trust": 1.7,
"url": "https://github.com/pjsip/pjproject/commit/077b465c33f0aec05a49cd2ca456f9a1b112e896"
},
{
"trust": 1.7,
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html"
},
{
"trust": 1.7,
"url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"
},
{
"trust": 1.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21723"
},
{
"trust": 1.1,
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html"
},
{
"trust": 1.0,
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/169618/gentoo-linux-security-advisory-202210-37.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0943"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/169938/debian-security-advisory-5285-1.html"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022022414"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/asterisk-out-of-bounds-memory-reading-via-pjproject-multipart-sip-message-37714"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022030601"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43804"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23608"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43845"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24764"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21722"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-37706"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24763"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/125.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014998"
},
{
"trust": 0.1,
"url": "https://github.com/alphabugx/cve-2022-23305"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24793"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-39244"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-41141"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24754"
},
{
"trust": 0.1,
"url": "https://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-39269"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24786"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24792"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-31031"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-32686"
},
{
"trust": 0.1,
"url": "https://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43299"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43303"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-46837"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43301"
},
{
"trust": 0.1,
"url": "https://issues.asterisk.org/jira/browse/asterisk-29017."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43300"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43302"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/asterisk"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-006.html"
},
{
"trust": 0.1,
"url": "http://www.asterisk.org/security"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-006.pdf"
},
{
"trust": 0.1,
"url": "https://downloads.asterisk.org/pub/security/ast-2022-006.html"
},
{
"trust": 0.1,
"url": "https://issues.asterisk.org/jira/browse/asterisk-29945"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-006-19.diff"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-006-16.8.diff"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-006-16.diff"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-006-18.diff"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-21723"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "166227"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-2496"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-004350"
},
{
"db": "NVD",
"id": "CVE-2022-21723"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2022-21723"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "166227"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-2496"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-004350"
},
{
"db": "NVD",
"id": "CVE-2022-21723"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-01-27T00:00:00",
"db": "VULMON",
"id": "CVE-2022-21723"
},
{
"date": "2022-11-01T13:21:55",
"db": "PACKETSTORM",
"id": "169618"
},
{
"date": "2022-11-18T14:28:10",
"db": "PACKETSTORM",
"id": "169938"
},
{
"date": "2022-03-07T16:29:41",
"db": "PACKETSTORM",
"id": "166227"
},
{
"date": "2022-01-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202201-2496"
},
{
"date": "2023-04-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-004350"
},
{
"date": "2022-01-27T00:15:07.737000",
"db": "NVD",
"id": "CVE-2022-21723"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-08-30T00:00:00",
"db": "VULMON",
"id": "CVE-2022-21723"
},
{
"date": "2022-11-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202201-2496"
},
{
"date": "2023-04-10T01:24:00",
"db": "JVNDB",
"id": "JVNDB-2022-004350"
},
{
"date": "2025-11-04T16:15:46.583000",
"db": "NVD",
"id": "CVE-2022-21723"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202201-2496"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "PJSIP\u00a0 Out-of-bounds read vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-004350"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202201-2496"
}
],
"trust": 0.6
}
}
VAR-202202-0167
Vulnerability from variot - Updated: 2025-11-18 12:34PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue. Teluu Ltd. of PJSIP Products from multiple other vendors contain vulnerabilities related to use of freed memory.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202210-37
https://security.gentoo.org/
Severity: Normal Title: PJSIP: Multiple Vulnerabilities Date: October 31, 2022 Bugs: #803614, #829894, #875863 ID: 202210-37
Synopsis
Multiple vulnerabilities have been found in PJSIP, the worst of which could result in arbitrary code execution.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/pjproject < 2.12.1 >= 2.12.1
Description
Multiple vulnerabilities have been discovered in PJSIP. Please review the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Resolution
All PJSIP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/pjproject-2.12.1"
References
[ 1 ] CVE-2021-32686 https://nvd.nist.gov/vuln/detail/CVE-2021-32686 [ 2 ] CVE-2021-37706 https://nvd.nist.gov/vuln/detail/CVE-2021-37706 [ 3 ] CVE-2021-41141 https://nvd.nist.gov/vuln/detail/CVE-2021-41141 [ 4 ] CVE-2021-43804 https://nvd.nist.gov/vuln/detail/CVE-2021-43804 [ 5 ] CVE-2021-43845 https://nvd.nist.gov/vuln/detail/CVE-2021-43845 [ 6 ] CVE-2022-21722 https://nvd.nist.gov/vuln/detail/CVE-2022-21722 [ 7 ] CVE-2022-21723 https://nvd.nist.gov/vuln/detail/CVE-2022-21723 [ 8 ] CVE-2022-23608 https://nvd.nist.gov/vuln/detail/CVE-2022-23608 [ 9 ] CVE-2022-24754 https://nvd.nist.gov/vuln/detail/CVE-2022-24754 [ 10 ] CVE-2022-24763 https://nvd.nist.gov/vuln/detail/CVE-2022-24763 [ 11 ] CVE-2022-24764 https://nvd.nist.gov/vuln/detail/CVE-2022-24764 [ 12 ] CVE-2022-24786 https://nvd.nist.gov/vuln/detail/CVE-2022-24786 [ 13 ] CVE-2022-24792 https://nvd.nist.gov/vuln/detail/CVE-2022-24792 [ 14 ] CVE-2022-24793 https://nvd.nist.gov/vuln/detail/CVE-2022-24793 [ 15 ] CVE-2022-31031 https://nvd.nist.gov/vuln/detail/CVE-2022-31031 [ 16 ] CVE-2022-39244 https://nvd.nist.gov/vuln/detail/CVE-2022-39244 [ 17 ] CVE-2022-39269 https://nvd.nist.gov/vuln/detail/CVE-2022-39269
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202210-37
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Debian Security Advisory DSA-5285-1 security@debian.org https://www.debian.org/security/ Markus Koschany November 17, 2022 https://www.debian.org/security/faq
Package : asterisk CVE ID : CVE-2021-37706 CVE-2021-43299 CVE-2021-43300 CVE-2021-43301 CVE-2021-43302 CVE-2021-43303 CVE-2021-43804 CVE-2021-43845 CVE-2021-46837 CVE-2022-21722 CVE-2022-21723 CVE-2022-23608 CVE-2022-24763 CVE-2022-24764 CVE-2022-24786 CVE-2022-24792 CVE-2022-24793 CVE-2022-26498 CVE-2022-26499 CVE-2022-26651 Debian Bug : 1014998 1018073 1014976
Multiple security vulnerabilities have been found in Asterisk, an Open Source Private Branch Exchange. Buffer overflows and other programming errors could be exploited for information disclosure or the execution of arbitrary code.
Special care should be taken when upgrading to this new upstream release. Some configuration files and options have changed in order to remedy certain security vulnerabilities. Most notably the pjsip TLS listener only accepts TLSv1.3 connections in the default configuration now. This can be reverted by adding method=tlsv1_2 to the transport in pjsip.conf. See also https://issues.asterisk.org/jira/browse/ASTERISK-29017.
For the stable distribution (bullseye), these problems have been fixed in version 1:16.28.0~dfsg-0+deb11u1.
We recommend that you upgrade your asterisk packages.
For the detailed security status of asterisk please refer to its security tracker page at: https://security-tracker.debian.org/tracker/asterisk
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmN2qoFfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeR0pQ/+Kr+FWFeFyrkFTyVv5BGBJug+EvZzzC2JZoI/TNsiAWQi/BZTQJ0pmdZr EHokqN7Z35EqZW6sj5aypdK7bOv4N+uv6P59xROk1KjEEG6XttGJ2BUvffWYWEXo k6+ou/yfAxU72Ufd1eOcMtjyGeN0CljmemIJ5Cywpnaw8YArP+VzRK2NEth0gCmJ TAfSvIPFaS7jB6fEg8KESOpmvtlqEJUh5sjP2t+OOEc3AoNBBuj4ZC44SQ1nif6k jEbmLFnJYQF8dP+IasZ3SY80N+BeuGiylZQ6w1ZvuYuUAK3jhHQ3CJvTQ4sEqNQV Zva6t0kHOEKVxKg412oEpQ0ihR+EBF/lnECu7iR2HTKk8xteNwio5qeeW/joTAJx OTYlHTtERTZIiaHdmV3nmGYgrTLeDHClilCnJrQuyXF+LVHjxBWDh7WS83zSrdIH gNP0eZ5UEjrpomf1yKqHVUsji63eSWACdFVXJLACMwpuevq8qgV6zASD+VuUd36r foEOKVj+FIHehWSef9pP48Na8bOn0EDVqtZEPOjE6o8Y8PjgSf7BSNogppZncldw VREox9NsxGM9hSVh3lVBWL8lT76HQVzXjfXXXoIEFDiGokNRV/dNTuhhb/mh0zxr VTKBboC6ijQVCdVQ7UdGFnoVXOWW2gy8sdam40ELBUCGDD5XI7A\xeajm -----END PGP SIGNATURE----- . ========================================================================== Ubuntu Security Notice USN-6422-1 October 09, 2023
ring vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.04
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in Ring.
Software Description: - ring: Secure and distributed voice, video, and chat platform
Details:
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2021-37706)
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302, CVE-2021-43303, CVE-2021-43804, CVE-2021-43845, CVE-2022-21723, CVE-2022-23537, CVE-2022-23547, CVE-2022-23608, CVE-2022-24754, CVE-2022-24763, CVE-2022-24764, CVE-2022-24793, CVE-2022-31031, CVE-2022-39244)
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-21722)
It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-27585)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 23.04: jami 20230206.0~ds1-5ubuntu0.1 jami-daemon 20230206.0~ds1-5ubuntu0.1
Ubuntu 20.04 LTS: jami 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 jami-daemon 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 ring 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 ring-daemon 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro): ring 20180228.1.503da2b~ds1-1ubuntu0.1~esm1 ring-daemon 20180228.1.503da2b~ds1-1ubuntu0.1~esm1
In general, a standard system update will make all the necessary changes.
References: https://ubuntu.com/security/notices/USN-6422-1 CVE-2021-37706, CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302, CVE-2021-43303, CVE-2021-43804, CVE-2021-43845, CVE-2022-21722, CVE-2022-21723, CVE-2022-23537, CVE-2022-23547, CVE-2022-23608, CVE-2022-24754, CVE-2022-24763, CVE-2022-24764, CVE-2022-24793, CVE-2022-31031, CVE-2022-39244, CVE-2023-27585
Package Information: https://launchpad.net/ubuntu/+source/ring/20230206.0~ds1-5ubuntu0.1
https://launchpad.net/ubuntu/+source/ring/20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1
. Asterisk Project Security Advisory - AST-2022-005
Product Asterisk
Summary pjproject: undefined behavior after freeing a dialog
set
Nature of Advisory Denial of service
Susceptibility Remote unauthenticated sessions
Severity Major
Exploits Known Yes
Reported On March 3, 2022
Reported By Sauw Ming
Posted On March 4, 2022
Last Updated On March 3, 2022
Advisory Contact kharwell AT sangoma DOT com
CVE Name CVE-2022-23608
Description When acting as a UAC, and when placing an outgoing
call to a target that then forks Asterisk may
experience undefined behavior (crashes, hangs, etc…)
after a dialog set is prematurely freed.
Modules Affected bundled pjproject
Resolution If you use “with-pjproject-bundled” then upgrade to, or
install one of, the versions of Asterisk listed below.
Otherwise install the appropriate version of pjproject that
contains the patch.
Affected Versions
Product Release Series
Asterisk Open Source 16.x All versions
Asterisk Open Source 18.x All versions
Asterisk Open Source 19.x All versions
Certified Asterisk 16.x All versions
Corrected In
Product Release
Asterisk Open Source 16.24.1,18.10.1,19.2.1
Certified Asterisk 16.8-cert13
Patches
Patch URL Revision
https://downloads.digium.com/pub/security/AST-2022-005-16.diff Asterisk
16
https://downloads.digium.com/pub/security/AST-2022-005-18.diff Asterisk
18
https://downloads.digium.com/pub/security/AST-2022-005-19.diff Asterisk
19
https://downloads.digium.com/pub/security/AST-2022-005-16.8.diff Certified
Asterisk
16.8
Links https://issues.asterisk.org/jira/browse/ASTERISK-29945
https://downloads.asterisk.org/pub/security/AST-2022-005.html
https://github.com/pjsip/pjproject/security/advisories/GHSA-ffff-m5fm-qm62
Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest
version will be posted at
https://downloads.digium.com/pub/security/AST-2022-005.pdf and
https://downloads.digium.com/pub/security/AST-2022-005.html
Revision History
Date Editor Revisions Made
March 3, 2022 Kevin Harwell Initial revision
Asterisk Project Security Advisory - AST-2022-005
Copyright © 2022 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its original, unaltered form
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202202-0167",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "16.24.1"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "18.0.0"
},
{
"model": "pjsip",
"scope": "lte",
"trust": 1.0,
"vendor": "teluu",
"version": "2.11.1"
},
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "18.10.1"
},
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "19.2.1"
},
{
"model": "certified asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "asterisk",
"version": "16.8.0"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "19.0.0"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "16.0.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "10.0"
},
{
"model": "certified asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "16.8.0"
},
{
"model": "pjsip",
"scope": null,
"trust": 0.8,
"vendor": "teluu",
"version": null
},
{
"model": "gnu/linux",
"scope": null,
"trust": 0.8,
"vendor": "debian",
"version": null
},
{
"model": "certified asterisk",
"scope": null,
"trust": 0.8,
"vendor": "asterisk",
"version": null
},
{
"model": "asterisk",
"scope": null,
"trust": 0.8,
"vendor": "sangoma",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-006237"
},
{
"db": "NVD",
"id": "CVE-2022-23608"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Gentoo",
"sources": [
{
"db": "PACKETSTORM",
"id": "169618"
}
],
"trust": 0.1
},
"cve": "CVE-2022-23608",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2022-23608",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2022-23608",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "security-advisories@github.com",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"id": "CVE-2022-23608",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-23608",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-23608",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "security-advisories@github.com",
"id": "CVE-2022-23608",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2022-23608",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-202202-1757",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2022-23608",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-23608"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1757"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006237"
},
{
"db": "NVD",
"id": "CVE-2022-23608"
},
{
"db": "NVD",
"id": "CVE-2022-23608"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue. Teluu Ltd. of PJSIP Products from multiple other vendors contain vulnerabilities related to use of freed memory.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 202210-37\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: PJSIP: Multiple Vulnerabilities\n Date: October 31, 2022\n Bugs: #803614, #829894, #875863\n ID: 202210-37\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n=======\nMultiple vulnerabilities have been found in PJSIP, the worst of which\ncould result in arbitrary code execution. \n\nAffected packages\n================\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 net-libs/pjproject \u003c 2.12.1 \u003e= 2.12.1\n\nDescription\n==========\nMultiple vulnerabilities have been discovered in PJSIP. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n=====\nPlease review the referenced CVE identifiers for details. \n\nResolution\n=========\nAll PJSIP users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-libs/pjproject-2.12.1\"\n\nReferences\n=========\n[ 1 ] CVE-2021-32686\n https://nvd.nist.gov/vuln/detail/CVE-2021-32686\n[ 2 ] CVE-2021-37706\n https://nvd.nist.gov/vuln/detail/CVE-2021-37706\n[ 3 ] CVE-2021-41141\n https://nvd.nist.gov/vuln/detail/CVE-2021-41141\n[ 4 ] CVE-2021-43804\n https://nvd.nist.gov/vuln/detail/CVE-2021-43804\n[ 5 ] CVE-2021-43845\n https://nvd.nist.gov/vuln/detail/CVE-2021-43845\n[ 6 ] CVE-2022-21722\n https://nvd.nist.gov/vuln/detail/CVE-2022-21722\n[ 7 ] CVE-2022-21723\n https://nvd.nist.gov/vuln/detail/CVE-2022-21723\n[ 8 ] CVE-2022-23608\n https://nvd.nist.gov/vuln/detail/CVE-2022-23608\n[ 9 ] CVE-2022-24754\n https://nvd.nist.gov/vuln/detail/CVE-2022-24754\n[ 10 ] CVE-2022-24763\n https://nvd.nist.gov/vuln/detail/CVE-2022-24763\n[ 11 ] CVE-2022-24764\n https://nvd.nist.gov/vuln/detail/CVE-2022-24764\n[ 12 ] CVE-2022-24786\n https://nvd.nist.gov/vuln/detail/CVE-2022-24786\n[ 13 ] CVE-2022-24792\n https://nvd.nist.gov/vuln/detail/CVE-2022-24792\n[ 14 ] CVE-2022-24793\n https://nvd.nist.gov/vuln/detail/CVE-2022-24793\n[ 15 ] CVE-2022-31031\n https://nvd.nist.gov/vuln/detail/CVE-2022-31031\n[ 16 ] CVE-2022-39244\n https://nvd.nist.gov/vuln/detail/CVE-2022-39244\n[ 17 ] CVE-2022-39269\n https://nvd.nist.gov/vuln/detail/CVE-2022-39269\n\nAvailability\n===========\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202210-37\n\nConcerns?\n========\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n======\nCopyright 2022 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-5285-1 security@debian.org\nhttps://www.debian.org/security/ Markus Koschany\nNovember 17, 2022 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : asterisk\nCVE ID : CVE-2021-37706 CVE-2021-43299 CVE-2021-43300 CVE-2021-43301\n CVE-2021-43302 CVE-2021-43303 CVE-2021-43804 CVE-2021-43845\n CVE-2021-46837 CVE-2022-21722 CVE-2022-21723 CVE-2022-23608\n CVE-2022-24763 CVE-2022-24764 CVE-2022-24786 CVE-2022-24792\n CVE-2022-24793 CVE-2022-26498 CVE-2022-26499 CVE-2022-26651\nDebian Bug : 1014998 1018073 1014976\n\nMultiple security vulnerabilities have been found in Asterisk, an Open Source\nPrivate Branch Exchange. Buffer overflows and other programming errors could be\nexploited for information disclosure or the execution of arbitrary code. \n\nSpecial care should be taken when upgrading to this new upstream release. \nSome configuration files and options have changed in order to remedy\ncertain security vulnerabilities. Most notably the pjsip TLS listener only\naccepts TLSv1.3 connections in the default configuration now. This can be\nreverted by adding method=tlsv1_2 to the transport in pjsip.conf. See also\nhttps://issues.asterisk.org/jira/browse/ASTERISK-29017. \n\nFor the stable distribution (bullseye), these problems have been fixed in\nversion 1:16.28.0~dfsg-0+deb11u1. \n\nWe recommend that you upgrade your asterisk packages. \n\nFor the detailed security status of asterisk please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/asterisk\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmN2qoFfFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD\nRjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7\nUeR0pQ/+Kr+FWFeFyrkFTyVv5BGBJug+EvZzzC2JZoI/TNsiAWQi/BZTQJ0pmdZr\nEHokqN7Z35EqZW6sj5aypdK7bOv4N+uv6P59xROk1KjEEG6XttGJ2BUvffWYWEXo\nk6+ou/yfAxU72Ufd1eOcMtjyGeN0CljmemIJ5Cywpnaw8YArP+VzRK2NEth0gCmJ\nTAfSvIPFaS7jB6fEg8KESOpmvtlqEJUh5sjP2t+OOEc3AoNBBuj4ZC44SQ1nif6k\njEbmLFnJYQF8dP+IasZ3SY80N+BeuGiylZQ6w1ZvuYuUAK3jhHQ3CJvTQ4sEqNQV\nZva6t0kHOEKVxKg412oEpQ0ihR+EBF/lnECu7iR2HTKk8xteNwio5qeeW/joTAJx\nOTYlHTtERTZIiaHdmV3nmGYgrTLeDHClilCnJrQuyXF+LVHjxBWDh7WS83zSrdIH\ngNP0eZ5UEjrpomf1yKqHVUsji63eSWACdFVXJLACMwpuevq8qgV6zASD+VuUd36r\nfoEOKVj+FIHehWSef9pP48Na8bOn0EDVqtZEPOjE6o8Y8PjgSf7BSNogppZncldw\nVREox9NsxGM9hSVh3lVBWL8lT76HQVzXjfXXXoIEFDiGokNRV/dNTuhhb/mh0zxr\nVTKBboC6ijQVCdVQ7UdGFnoVXOWW2gy8sdam40ELBUCGDD5XI7A\\xeajm\n-----END PGP SIGNATURE-----\n. ==========================================================================\nUbuntu Security Notice USN-6422-1\nOctober 09, 2023\n\nring vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 23.04\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS (Available with Ubuntu Pro)\n\nSummary:\n\nSeveral security issues were fixed in Ring. \n\nSoftware Description:\n- ring: Secure and distributed voice, video, and chat platform\n\nDetails:\n\nIt was discovered that Ring incorrectly handled certain inputs. If a user or\nan automated system were tricked into opening a specially crafted input file,\na remote attacker could possibly use this issue to execute arbitrary code. \n(CVE-2021-37706)\n\nIt was discovered that Ring incorrectly handled certain inputs. If a user or\nan automated system were tricked into opening a specially crafted input file,\na remote attacker could possibly use this issue to cause a denial of service. \nThis issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. \n(CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302,\nCVE-2021-43303, CVE-2021-43804, CVE-2021-43845, CVE-2022-21723,\nCVE-2022-23537, CVE-2022-23547, CVE-2022-23608, CVE-2022-24754,\nCVE-2022-24763, CVE-2022-24764, CVE-2022-24793, CVE-2022-31031,\nCVE-2022-39244)\n\nIt was discovered that Ring incorrectly handled certain inputs. If a user or\nan automated system were tricked into opening a specially crafted input file,\na remote attacker could possibly use this issue to cause a denial of service. \nThis issue only affected Ubuntu 20.04 LTS. (CVE-2022-21722)\n\nIt was discovered that Ring incorrectly handled certain inputs. If a user or\nan automated system were tricked into opening a specially crafted input file,\na remote attacker could possibly use this issue to cause a denial of service. \n(CVE-2023-27585)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 23.04:\n jami 20230206.0~ds1-5ubuntu0.1\n jami-daemon 20230206.0~ds1-5ubuntu0.1\n\nUbuntu 20.04 LTS:\n jami 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1\n jami-daemon 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1\n ring 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1\n ring-daemon 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1\n\nUbuntu 18.04 LTS (Available with Ubuntu Pro):\n ring 20180228.1.503da2b~ds1-1ubuntu0.1~esm1\n ring-daemon 20180228.1.503da2b~ds1-1ubuntu0.1~esm1\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n https://ubuntu.com/security/notices/USN-6422-1\n CVE-2021-37706, CVE-2021-43299, CVE-2021-43300, CVE-2021-43301,\n CVE-2021-43302, CVE-2021-43303, CVE-2021-43804, CVE-2021-43845,\n CVE-2022-21722, CVE-2022-21723, CVE-2022-23537, CVE-2022-23547,\n CVE-2022-23608, CVE-2022-24754, CVE-2022-24763, CVE-2022-24764,\n CVE-2022-24793, CVE-2022-31031, CVE-2022-39244, CVE-2023-27585\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/ring/20230206.0~ds1-5ubuntu0.1\n \nhttps://launchpad.net/ubuntu/+source/ring/20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1\n\n. Asterisk Project Security Advisory - AST-2022-005\n\n Product Asterisk \n Summary pjproject: undefined behavior after freeing a dialog \n set \n Nature of Advisory Denial of service \n Susceptibility Remote unauthenticated sessions \n Severity Major \n Exploits Known Yes \n Reported On March 3, 2022 \n Reported By Sauw Ming \n Posted On March 4, 2022 \n Last Updated On March 3, 2022 \n Advisory Contact kharwell AT sangoma DOT com \n CVE Name CVE-2022-23608 \n\n Description When acting as a UAC, and when placing an outgoing \n call to a target that then forks Asterisk may \n experience undefined behavior (crashes, hangs, etc\u2026) \n after a dialog set is prematurely freed. \n Modules Affected bundled pjproject \n\n Resolution If you use \u201cwith-pjproject-bundled\u201d then upgrade to, or \n install one of, the versions of Asterisk listed below. \n Otherwise install the appropriate version of pjproject that \n contains the patch. \n\n Affected Versions\n Product Release Series \n Asterisk Open Source 16.x All versions \n Asterisk Open Source 18.x All versions \n Asterisk Open Source 19.x All versions \n Certified Asterisk 16.x All versions \n\n Corrected In\n Product Release \n Asterisk Open Source 16.24.1,18.10.1,19.2.1 \n Certified Asterisk 16.8-cert13 \n\n Patches \n Patch URL Revision \n https://downloads.digium.com/pub/security/AST-2022-005-16.diff Asterisk \n 16 \n https://downloads.digium.com/pub/security/AST-2022-005-18.diff Asterisk \n 18 \n https://downloads.digium.com/pub/security/AST-2022-005-19.diff Asterisk \n 19 \n https://downloads.digium.com/pub/security/AST-2022-005-16.8.diff Certified \n Asterisk \n 16.8 \n\nLinks https://issues.asterisk.org/jira/browse/ASTERISK-29945 \n \n https://downloads.asterisk.org/pub/security/AST-2022-005.html \n \n https://github.com/pjsip/pjproject/security/advisories/GHSA-ffff-m5fm-qm62 \n\n Asterisk Project Security Advisories are posted at \n http://www.asterisk.org/security \n \n This document may be superseded by later versions; if so, the latest \n version will be posted at \n https://downloads.digium.com/pub/security/AST-2022-005.pdf and \n https://downloads.digium.com/pub/security/AST-2022-005.html \n\n Revision History\n Date Editor Revisions Made \n March 3, 2022 Kevin Harwell Initial revision \n\n Asterisk Project Security Advisory - AST-2022-005\n Copyright \u00a9 2022 Digium, Inc. All Rights Reserved. \n Permission is hereby granted to distribute and publish this advisory in its\n original, unaltered form",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-23608"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006237"
},
{
"db": "VULMON",
"id": "CVE-2022-23608"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "175025"
},
{
"db": "PACKETSTORM",
"id": "166226"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-23608",
"trust": 3.7
},
{
"db": "PACKETSTORM",
"id": "166226",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006237",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "169618",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "169938",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2022.0942",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.1414",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022022414",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022030601",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1757",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-23608",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "175025",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-23608"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "175025"
},
{
"db": "PACKETSTORM",
"id": "166226"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1757"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006237"
},
{
"db": "NVD",
"id": "CVE-2022-23608"
}
]
},
"id": "VAR-202202-0167",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.348297215
},
"last_update_date": "2025-11-18T12:34:49.883000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "PJSIP Remediation of resource management error vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=184333"
},
{
"title": "Debian CVElist Bug Report Logs: ring: CVE-2021-32686 CVE-2021-37706 CVE-2022-21723 CVE-2022-23608 CVE-2021-43299 CVE-2021-43300 CVE-2021-43301 CVE-2021-43302 CVE-2021-43303 CVE-2021-43804 CVE-2021-43845 CVE-2022-21722 CVE-2022-24754 CVE-2022-24763 CVE-2022-24764 CVE-2022-24793",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=4e89fc7b47aa12e94340b2e2db73b906"
},
{
"title": "Debian Security Advisories: DSA-5285-1 asterisk -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=edc2cf0db8c0593c65c4c82227026727"
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/AlphabugX/CVE-2022-23305 "
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/AlphabugX/CVE-2022-RCE "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-23608"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1757"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-416",
"trust": 1.0
},
{
"problemtype": "Use of freed memory (CWE-416) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-006237"
},
{
"db": "NVD",
"id": "CVE-2022-23608"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://packetstormsecurity.com/files/166226/asterisk-project-security-advisory-ast-2022-005.html"
},
{
"trust": 2.6,
"url": "https://github.com/pjsip/pjproject/security/advisories/ghsa-ffff-m5fm-qm62"
},
{
"trust": 2.6,
"url": "https://security.gentoo.org/glsa/202210-37"
},
{
"trust": 2.6,
"url": "https://www.debian.org/security/2022/dsa-5285"
},
{
"trust": 2.5,
"url": "https://github.com/pjsip/pjproject/commit/db3235953baa56d2fb0e276ca510fefca751643f"
},
{
"trust": 2.5,
"url": "http://seclists.org/fulldisclosure/2022/mar/1"
},
{
"trust": 2.5,
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html"
},
{
"trust": 2.5,
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00040.html"
},
{
"trust": 2.5,
"url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"
},
{
"trust": 1.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23608"
},
{
"trust": 1.1,
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html"
},
{
"trust": 1.0,
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/169618/gentoo-linux-security-advisory-202210-37.html"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/asterisk-reuse-after-free-via-pjproject-dialog-set-37713"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-23608/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/169938/debian-security-advisory-5285-1.html"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022022414"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022030601"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0942"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.1414"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43804"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24764"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21722"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-37706"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24763"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24793"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-39244"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43845"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21723"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43303"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43302"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/416.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014998"
},
{
"trust": 0.1,
"url": "https://github.com/alphabugx/cve-2022-23305"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-41141"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24754"
},
{
"trust": 0.1,
"url": "https://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-39269"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24786"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24792"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-31031"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-32686"
},
{
"trust": 0.1,
"url": "https://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43299"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-46837"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43301"
},
{
"trust": 0.1,
"url": "https://issues.asterisk.org/jira/browse/asterisk-29017."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43300"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/asterisk"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-6422-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/ring/20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-27585"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23537"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/ring/20230206.0~ds1-5ubuntu0.1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23547"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-005-18.diff"
},
{
"trust": 0.1,
"url": "https://downloads.asterisk.org/pub/security/ast-2022-005.html"
},
{
"trust": 0.1,
"url": "http://www.asterisk.org/security"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-005-19.diff"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-005.pdf"
},
{
"trust": 0.1,
"url": "https://issues.asterisk.org/jira/browse/asterisk-29945"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-005.html"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-005-16.diff"
},
{
"trust": 0.1,
"url": "https://downloads.digium.com/pub/security/ast-2022-005-16.8.diff"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-23608"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "175025"
},
{
"db": "PACKETSTORM",
"id": "166226"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1757"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006237"
},
{
"db": "NVD",
"id": "CVE-2022-23608"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2022-23608"
},
{
"db": "PACKETSTORM",
"id": "169618"
},
{
"db": "PACKETSTORM",
"id": "169938"
},
{
"db": "PACKETSTORM",
"id": "175025"
},
{
"db": "PACKETSTORM",
"id": "166226"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1757"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006237"
},
{
"db": "NVD",
"id": "CVE-2022-23608"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-02-22T00:00:00",
"db": "VULMON",
"id": "CVE-2022-23608"
},
{
"date": "2022-11-01T13:21:55",
"db": "PACKETSTORM",
"id": "169618"
},
{
"date": "2022-11-18T14:28:10",
"db": "PACKETSTORM",
"id": "169938"
},
{
"date": "2023-10-10T14:47:37",
"db": "PACKETSTORM",
"id": "175025"
},
{
"date": "2022-03-07T16:28:25",
"db": "PACKETSTORM",
"id": "166226"
},
{
"date": "2022-02-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202202-1757"
},
{
"date": "2023-07-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-006237"
},
{
"date": "2022-02-22T20:15:07.693000",
"db": "NVD",
"id": "CVE-2022-23608"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-08-30T00:00:00",
"db": "VULMON",
"id": "CVE-2022-23608"
},
{
"date": "2022-11-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202202-1757"
},
{
"date": "2023-07-03T08:38:00",
"db": "JVNDB",
"id": "JVNDB-2022-006237"
},
{
"date": "2025-11-04T16:15:47.087000",
"db": "NVD",
"id": "CVE-2022-23608"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "175025"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1757"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Teluu\u00a0Ltd.\u00a0 of \u00a0PJSIP\u00a0 Vulnerability related to use of freed memory in products from other vendors",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-006237"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202202-1757"
}
],
"trust": 0.6
}
}
VAR-201706-0901
Vulnerability from variot - Updated: 2025-04-20 23:25A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packets causing an infinite loop and leading to memory exhaustion (by message logging in that loop). Asterisk Open Source and Certified Asterisk Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Multiple Asterisk products are prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201706-0901",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "certified asterisk",
"scope": "eq",
"trust": 1.6,
"vendor": "asterisk",
"version": "13.13.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.14.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.4.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.13.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "14.4.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "14.0.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.12.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.3.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.12.2"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.1.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "14.2.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.8.2"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.8.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.2.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.12.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "14.3.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.11.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.9.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.5.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.8.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.0.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.15.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.10.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "14.1.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.7.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.6.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "sangoma",
"version": "14.2.0"
},
{
"model": "asterisk open source",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "14.x"
},
{
"model": "certified asterisk",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "13.13-cert4"
},
{
"model": "certified asterisk",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "13.13"
},
{
"model": "asterisk open source",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "13.15.1"
},
{
"model": "asterisk open source",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "14.4.1"
},
{
"model": "asterisk open source",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "13.x"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.6,
"vendor": "asterisk",
"version": "14.1.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.6,
"vendor": "asterisk",
"version": "14.2.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.6,
"vendor": "asterisk",
"version": "14.4.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.6,
"vendor": "asterisk",
"version": "14.3.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.6,
"vendor": "asterisk",
"version": "14.0.0"
},
{
"model": "certified asterisk 13.13-cert3",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "certified asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "13.13"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "13.7.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "13.3.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "13.0.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "14.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "13.8.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "13.1.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "13.0.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "13.0"
},
{
"model": "certified asterisk 13.13-cert4",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "open source",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": "14.4.1"
},
{
"model": "open source",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": "13.15.1"
}
],
"sources": [
{
"db": "BID",
"id": "98573"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004594"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-060"
},
{
"db": "NVD",
"id": "CVE-2017-9358"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:digium:open_source",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:digium:certified_asterisk",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-004594"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sandro Gauci",
"sources": [
{
"db": "BID",
"id": "98573"
}
],
"trust": 0.3
},
"cve": "CVE-2017-9358",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-9358",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2017-9358",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-9358",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-9358",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201706-060",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-004594"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-060"
},
{
"db": "NVD",
"id": "CVE-2017-9358"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packets causing an infinite loop and leading to memory exhaustion (by message logging in that loop). Asterisk Open Source and Certified Asterisk Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Multiple Asterisk products are prone to a remote denial-of-service vulnerability. \nAn attacker can exploit this issue to cause a denial-of-service condition",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9358"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004594"
},
{
"db": "BID",
"id": "98573"
}
],
"trust": 1.89
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-9358",
"trust": 2.7
},
{
"db": "BID",
"id": "98573",
"trust": 1.9
},
{
"db": "SECTRACK",
"id": "1038531",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004594",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201706-060",
"trust": 0.6
}
],
"sources": [
{
"db": "BID",
"id": "98573"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004594"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-060"
},
{
"db": "NVD",
"id": "CVE-2017-9358"
}
]
},
"id": "VAR-201706-0901",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.348297215
},
"last_update_date": "2025-04-20T23:25:00.675000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "AST-2017-004",
"trust": 0.8,
"url": "http://downloads.asterisk.org/pub/security/AST-2017-004.txt"
},
{
"title": "863906",
"trust": 0.8,
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863906"
},
{
"title": "Digium Asterisk Open Source and Certified Asterisk Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=70679"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-004594"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-060"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-835",
"trust": 1.0
},
{
"problemtype": "CWE-400",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-004594"
},
{
"db": "NVD",
"id": "CVE-2017-9358"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://downloads.asterisk.org/pub/security/ast-2017-004.txt"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/98573"
},
{
"trust": 1.6,
"url": "http://www.securitytracker.com/id/1038531"
},
{
"trust": 1.6,
"url": "https://bugs.debian.org/863906"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9358"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9358"
},
{
"trust": 0.3,
"url": "http://seclists.org/fulldisclosure/2017/may/76"
},
{
"trust": 0.3,
"url": "http://www.asterisk.org/"
},
{
"trust": 0.3,
"url": "http://downloads.asterisk.org/pub/security/ast-2017-004.html"
}
],
"sources": [
{
"db": "BID",
"id": "98573"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004594"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-060"
},
{
"db": "NVD",
"id": "CVE-2017-9358"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "98573"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004594"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-060"
},
{
"db": "NVD",
"id": "CVE-2017-9358"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-04-13T00:00:00",
"db": "BID",
"id": "98573"
},
{
"date": "2017-06-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-004594"
},
{
"date": "2017-06-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-060"
},
{
"date": "2017-06-02T05:29:00.700000",
"db": "NVD",
"id": "CVE-2017-9358"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-06-02T18:01:00",
"db": "BID",
"id": "98573"
},
{
"date": "2017-06-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-004594"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-060"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-9358"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-060"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Asterisk Open Source and Certified Asterisk Vulnerable to resource exhaustion",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-004594"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-060"
}
],
"trust": 0.6
}
}
VAR-201208-0619
Vulnerability from variot - Updated: 2025-04-11 23:08Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action. Asterisk is prone to a security-bypass vulnerability that affects the manager interface. An attacker can exploit this issue to bypass certain security restrictions and execute shell commands within the context of the affected application. Asterisk Project Security Advisory - AST-2012-012
Product Asterisk
Summary Asterisk Manager User Unauthorized Shell Access
Nature of Advisory Permission Escalation
Susceptibility Remote Authenticated Sessions
Severity Minor
Exploits Known No
Reported On July 13, 2012
Reported By Zubair Ashraf of IBM X-Force Research
Posted On August 30, 2012
Last Updated On August 30, 2012
Advisory Contact Matt Jordan < mjordan AT digium DOT com >
CVE Name CVE-2012-2186
Description The AMI Originate action can allow a remote user to specify
information that can be used to execute shell commands on
the system hosting Asterisk. This can result in an unwanted
escalation of permissions, as the Originate action, which
requires the "originate" class authorization, can be used
to perform actions that would typically require the
"system" class authorization. Previous attempts to prevent
this permission escalation (AST-2011-006, AST-2012-004)
have sought to do so by inspecting the names of
applications and functions passed in with the Originate
action and, if those applications/functions matched a
predefined set of values, rejecting the command if the user
lacked the "system" class authorization. As reported by IBM
X-Force Research, the "ExternalIVR" application is not
listed in the predefined set of values. The solution for
this particular vulnerability is to include the
"ExternalIVR" application in the set of defined
applications/functions that require "system" class
authorization.
Unfortunately, the approach of inspecting fields in the
Originate action against known applications/functions has a
significant flaw. The predefined set of values can be
bypassed by creative use of the Originate action or by
certain dialplan configurations, which is beyond the
ability of Asterisk to analyze at run-time. Attempting to
work around these scenarios would result in severely
restricting the applications or functions and prevent their
usage for legitimate means. As such, any additional
security vulnerabilities, where an application/function
that would normally require the "system" class
authorization can be executed by users with the "originate"
class authorization, will not be addressed. Proper system configuration can limit the impact
of such scenarios.
The next release of each version of Asterisk will contain,
in addition to the fix for the "ExternalIVR" application,
an updated README-SERIOUSLY.bestpractices.txt file.
Resolution Asterisk now checks for the "ExternalIVR" application when
processing the Originate action.
Additionally, the README-SERIOUSLY.bestpractices.txt file
has been updated. It is highly recommended that, if AMI is
utilized with accounts that have the "originate" class
authorization, Asterisk is run under a defined user that
does not have root permissions. Accounts with the
"originate" class authorization should be treated in a
similar manner to those with the "system" class
authorization. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its original, unaltered form. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201209-15
http://security.gentoo.org/
Severity: Normal Title: Asterisk: Multiple vulnerabilities Date: September 26, 2012 Bugs: #425050, #433750 ID: 201209-15
Synopsis
Multiple vulnerabilities have been found in Asterisk, the worst of which may allow execution of arbitrary code.
Background
Asterisk is an open source telephony engine and toolkit.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/asterisk < 1.8.15.1 >= 1.8.15.1
Description
Multiple vulnerabilities have been found in Asterisk:
- An error in manager.c allows shell access (CVE-2012-2186).
- An error in Asterisk could cause all RTP ports to be exhausted (CVE-2012-3812).
- A double-free error could occur when two parties attempt to manipulate the same voicemail account simultaneously (CVE-2012-3863).
- Asterisk does not properly implement certain ACL rules (CVE-2012-4737).
Impact
A remote, authenticated attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or bypass outbound call restrictions.
Workaround
There is no known workaround at this time.
Resolution
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.15.1"
References
[ 1 ] CVE-2012-2186 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2186 [ 2 ] CVE-2012-3812 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3812 [ 3 ] CVE-2012-3863 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3863 [ 4 ] CVE-2012-4737 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4737
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-15.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Debian Security Advisory DSA-2550-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff September 18, 2012 http://www.debian.org/security/faq
Package : asterisk Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2012-2186 CVE-2012-3812 CVE-2012-3863 CVE-2012-4737
Several vulnerabilities were discovered in Asterisk, a PBX and telephony toolkit, allowing privilege escalation in the Asterisk Manager, denial of service or privilege escalation.
More detailed information can be found in the Asterisk advisories: http://downloads.asterisk.org/pub/security/AST-2012-010.html http://downloads.asterisk.org/pub/security/AST-2012-011.html http://downloads.asterisk.org/pub/security/AST-2012-012.html http://downloads.asterisk.org/pub/security/AST-2012-013.html
For the stable distribution (squeeze), these problems have been fixed in version 1:1.6.2.9-2+squeeze7.
For the testing distribution (wheezy) and the unstable distribution (sid), these problems have been fixed in version 1:1.8.13.1~dfsg-1.
We recommend that you upgrade your asterisk packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlBYrLoACgkQXm3vHE4uylqDBgCfTQnp2Z1XZSgJkg1L84SDPnjK muwAoOINdMCYMfcEc8spGQ7wrCWPKGaR =FRM+ -----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Debian update for asterisk
SECUNIA ADVISORY ID: SA50687
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/50687/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=50687
RELEASE DATE: 2012-09-19
DISCUSS ADVISORY: http://secunia.com/advisories/50687/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/50687/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50687
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Debian has issued an update for asterisk.
For more information: SA49814 SA50456
SOLUTION: Apply updated packages via the apt-get package manager.
ORIGINAL ADVISORY: DSA-2550-1: http://www.debian.org/security/2012/dsa-2550
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201208-0619",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "open source",
"scope": "eq",
"trust": 1.6,
"vendor": "asterisk",
"version": "10.0.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.6,
"vendor": "asterisk",
"version": "1.8.5.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.6,
"vendor": "asterisk",
"version": "10.1.3"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.6,
"vendor": "asterisk",
"version": "1.8.5"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.6,
"vendor": "asterisk",
"version": "1.8.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.6,
"vendor": "asterisk",
"version": "10.2.0"
},
{
"model": "certified asterisk",
"scope": "eq",
"trust": 1.3,
"vendor": "asterisk",
"version": "1.8.11"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.3,
"vendor": "asterisk",
"version": "1.8.3.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.1.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.4.3"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.9.3"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.7.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.2.2"
},
{
"model": "digiumphones",
"scope": "lte",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.7.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.4.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.4"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.9.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.9.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.9.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.2.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.1.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.7"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.8.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.3"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.7.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.8.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.10.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.4.4"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.3.3"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.6.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.3.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.11.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.4.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.1.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.3"
},
{
"model": "business edition",
"scope": "lte",
"trust": 1.0,
"vendor": "asterisk",
"version": "c.3.7.5"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.10.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.11.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.2.4"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.8.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.12.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.1.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.3.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.4.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.0.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.7.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.3.1"
},
{
"model": "asterisk",
"scope": "lte",
"trust": 1.0,
"vendor": "sangoma",
"version": "10.7.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.2.3"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.1.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.2.1"
},
{
"model": "business edition",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "c.3.0"
},
{
"model": "asterisk",
"scope": "lte",
"trust": 1.0,
"vendor": "sangoma",
"version": "1.8.15.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.12"
},
{
"model": "certified asterisk",
"scope": "lte",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.11"
},
{
"model": "asterisk open source",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "1.8.15.1"
},
{
"model": "asterisk open source",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "10.7.1"
},
{
"model": "certified asterisk",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "1.8.11-cert6"
},
{
"model": "asterisk business edition",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "c.3.x"
},
{
"model": "asterisk open source",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "1.8.x"
},
{
"model": "asterisk business edition",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "c.3.7.6"
},
{
"model": "certified asterisk",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "1.8.11"
},
{
"model": "asterisk open source",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "10.x"
},
{
"model": "asterisk with digiumphones",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "10.x.x-digiumphones"
},
{
"model": "asterisk with digiumphones",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "10.7.1-digiumphones"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "10.7"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.6.2.17.1"
},
{
"model": "open source",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.6.1.23"
},
{
"model": "digiumphones 10.5.2-digiumphones",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "digiumphones 10.5.1-digiumphones",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "business edition c.3.7.5",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "business edition c.3.7.4",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "business edition c.3.7.3",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "business edition c.3.6.4",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "business edition c.3.6.3",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "business edition c.3.6.2",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "business edition c.3.3.2",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "business edition c.3.2",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "3"
},
{
"model": "business edition c.3.2",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "2"
},
{
"model": "business edition c.3.1.0",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "business edition c.3.1",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1"
},
{
"model": "certified asterisk 1.8.11-cert6",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "open source",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": "10.7.1"
},
{
"model": "open source",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.15.1"
},
{
"model": "digiumphones 10.7.1-digiumphones",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "business edition c.3.7.6",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": null
}
],
"sources": [
{
"db": "BID",
"id": "55351"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004020"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-683"
},
{
"db": "NVD",
"id": "CVE-2012-2186"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:digium:asterisk_business_edition",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:digium:open_source",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:digium:asterisk_digiumphones",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:digium:certified_asterisk",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004020"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Zubair Ashraf of IBM X-Force Research",
"sources": [
{
"db": "BID",
"id": "55351"
}
],
"trust": 0.3
},
"cve": "CVE-2012-2186",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2012-2186",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-2186",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2012-2186",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201208-683",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004020"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-683"
},
{
"db": "NVD",
"id": "CVE-2012-2186"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action. Asterisk is prone to a security-bypass vulnerability that affects the manager interface. \nAn attacker can exploit this issue to bypass certain security restrictions and execute shell commands within the context of the affected application. Asterisk Project Security Advisory - AST-2012-012\n\n Product Asterisk \n Summary Asterisk Manager User Unauthorized Shell Access \n Nature of Advisory Permission Escalation \n Susceptibility Remote Authenticated Sessions \n Severity Minor \n Exploits Known No \n Reported On July 13, 2012 \n Reported By Zubair Ashraf of IBM X-Force Research \n Posted On August 30, 2012 \n Last Updated On August 30, 2012 \n Advisory Contact Matt Jordan \u003c mjordan AT digium DOT com \u003e \n CVE Name CVE-2012-2186 \n\n Description The AMI Originate action can allow a remote user to specify \n information that can be used to execute shell commands on \n the system hosting Asterisk. This can result in an unwanted \n escalation of permissions, as the Originate action, which \n requires the \"originate\" class authorization, can be used \n to perform actions that would typically require the \n \"system\" class authorization. Previous attempts to prevent \n this permission escalation (AST-2011-006, AST-2012-004) \n have sought to do so by inspecting the names of \n applications and functions passed in with the Originate \n action and, if those applications/functions matched a \n predefined set of values, rejecting the command if the user \n lacked the \"system\" class authorization. As reported by IBM \n X-Force Research, the \"ExternalIVR\" application is not \n listed in the predefined set of values. The solution for \n this particular vulnerability is to include the \n \"ExternalIVR\" application in the set of defined \n applications/functions that require \"system\" class \n authorization. \n \n Unfortunately, the approach of inspecting fields in the \n Originate action against known applications/functions has a \n significant flaw. The predefined set of values can be \n bypassed by creative use of the Originate action or by \n certain dialplan configurations, which is beyond the \n ability of Asterisk to analyze at run-time. Attempting to \n work around these scenarios would result in severely \n restricting the applications or functions and prevent their \n usage for legitimate means. As such, any additional \n security vulnerabilities, where an application/function \n that would normally require the \"system\" class \n authorization can be executed by users with the \"originate\" \n class authorization, will not be addressed. Proper system configuration can limit the impact \n of such scenarios. \n \n The next release of each version of Asterisk will contain, \n in addition to the fix for the \"ExternalIVR\" application, \n an updated README-SERIOUSLY.bestpractices.txt file. \n\n Resolution Asterisk now checks for the \"ExternalIVR\" application when \n processing the Originate action. \n \n Additionally, the README-SERIOUSLY.bestpractices.txt file \n has been updated. It is highly recommended that, if AMI is \n utilized with accounts that have the \"originate\" class \n authorization, Asterisk is run under a defined user that \n does not have root permissions. Accounts with the \n \"originate\" class authorization should be treated in a \n similar manner to those with the \"system\" class \n authorization. All Rights Reserved. \n Permission is hereby granted to distribute and publish this advisory in its\n original, unaltered form. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201209-15\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: Asterisk: Multiple vulnerabilities\n Date: September 26, 2012\n Bugs: #425050, #433750\n ID: 201209-15\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Asterisk, the worst of\nwhich may allow execution of arbitrary code. \n\nBackground\n==========\n\nAsterisk is an open source telephony engine and toolkit. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 net-misc/asterisk \u003c 1.8.15.1 \u003e= 1.8.15.1\n\nDescription\n===========\n\nMultiple vulnerabilities have been found in Asterisk:\n\n* An error in manager.c allows shell access (CVE-2012-2186). \n* An error in Asterisk could cause all RTP ports to be exhausted\n (CVE-2012-3812). \n* A double-free error could occur when two parties attempt to\n manipulate the same voicemail account simultaneously (CVE-2012-3863). \n* Asterisk does not properly implement certain ACL rules\n (CVE-2012-4737). \n\nImpact\n======\n\nA remote, authenticated attacker could execute arbitrary code with the\nprivileges of the process, cause a Denial of Service condition, or\nbypass outbound call restrictions. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Asterisk users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-misc/asterisk-1.8.15.1\"\n\nReferences\n==========\n\n[ 1 ] CVE-2012-2186\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2186\n[ 2 ] CVE-2012-3812\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3812\n[ 3 ] CVE-2012-3863\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3863\n[ 4 ] CVE-2012-4737\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4737\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201209-15.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2012 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2550-1 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nSeptember 18, 2012 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : asterisk\nVulnerability : several\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2012-2186 CVE-2012-3812 CVE-2012-3863 CVE-2012-4737\n\nSeveral vulnerabilities were discovered in Asterisk, a PBX and telephony \ntoolkit, allowing privilege escalation in the Asterisk Manager, denial of\nservice or privilege escalation. \n\nMore detailed information can be found in the Asterisk advisories:\nhttp://downloads.asterisk.org/pub/security/AST-2012-010.html \nhttp://downloads.asterisk.org/pub/security/AST-2012-011.html \nhttp://downloads.asterisk.org/pub/security/AST-2012-012.html \nhttp://downloads.asterisk.org/pub/security/AST-2012-013.html \n\nFor the stable distribution (squeeze), these problems have been fixed in\nversion 1:1.6.2.9-2+squeeze7. \n\nFor the testing distribution (wheezy) and the unstable distribution (sid), \nthese problems have been fixed in version 1:1.8.13.1~dfsg-1. \n\nWe recommend that you upgrade your asterisk packages. \n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.12 (GNU/Linux)\n\niEYEARECAAYFAlBYrLoACgkQXm3vHE4uylqDBgCfTQnp2Z1XZSgJkg1L84SDPnjK\nmuwAoOINdMCYMfcEc8spGQ7wrCWPKGaR\n=FRM+\n-----END PGP SIGNATURE-----\n\n\n. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nDebian update for asterisk\n\nSECUNIA ADVISORY ID:\nSA50687\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/50687/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50687\n\nRELEASE DATE:\n2012-09-19\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/50687/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/50687/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50687\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nDebian has issued an update for asterisk. \n\nFor more information:\nSA49814\nSA50456\n\nSOLUTION:\nApply updated packages via the apt-get package manager. \n\nORIGINAL ADVISORY:\nDSA-2550-1:\nhttp://www.debian.org/security/2012/dsa-2550\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-2186"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004020"
},
{
"db": "BID",
"id": "55351"
},
{
"db": "PACKETSTORM",
"id": "116096"
},
{
"db": "PACKETSTORM",
"id": "116914"
},
{
"db": "PACKETSTORM",
"id": "116960"
},
{
"db": "PACKETSTORM",
"id": "116896"
},
{
"db": "PACKETSTORM",
"id": "116646"
},
{
"db": "PACKETSTORM",
"id": "116705"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-2186",
"trust": 3.1
},
{
"db": "SECUNIA",
"id": "50756",
"trust": 1.1
},
{
"db": "SECUNIA",
"id": "50687",
"trust": 1.1
},
{
"db": "SECTRACK",
"id": "1027460",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004020",
"trust": 0.8
},
{
"db": "NSFOCUS",
"id": "20761",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201208-683",
"trust": 0.6
},
{
"db": "BID",
"id": "55351",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "116096",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116914",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116960",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116896",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116646",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116705",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "55351"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004020"
},
{
"db": "PACKETSTORM",
"id": "116096"
},
{
"db": "PACKETSTORM",
"id": "116914"
},
{
"db": "PACKETSTORM",
"id": "116960"
},
{
"db": "PACKETSTORM",
"id": "116896"
},
{
"db": "PACKETSTORM",
"id": "116646"
},
{
"db": "PACKETSTORM",
"id": "116705"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-683"
},
{
"db": "NVD",
"id": "CVE-2012-2186"
}
]
},
"id": "VAR-201208-0619",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.348297215
},
"last_update_date": "2025-04-11T23:08:50.009000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "AST-2012-012",
"trust": 0.8,
"url": "http://downloads.asterisk.org/pub/security/AST-2012-012.html"
},
{
"title": "DSA-2550",
"trust": 0.8,
"url": "http://www.debian.org/security/2012/dsa-2550"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004020"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-nocwe",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004020"
},
{
"db": "NVD",
"id": "CVE-2012-2186"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-012.html"
},
{
"trust": 1.1,
"url": "http://www.debian.org/security/2012/dsa-2550"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/50756"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id?1027460"
},
{
"trust": 1.0,
"url": "http://secunia.com/advisories/50687"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2186"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2186"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/20761"
},
{
"trust": 0.4,
"url": "https://issues.asterisk.org/jira/browse/asterisk-20132"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2186"
},
{
"trust": 0.3,
"url": "http://www.asterisk.org/"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3812"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-4737"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3863"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.2,
"url": "http://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "http://downloads.digium.com/pub/security/ast-2012-012.pdf"
},
{
"trust": 0.1,
"url": "http://downloads.digium.com/pub/security/ast-2012-012.html"
},
{
"trust": 0.1,
"url": "http://www.asterisk.org/security"
},
{
"trust": 0.1,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-012-1.8.diff"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-3863"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2186"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-201209-15.xml"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-3812"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-4737"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/50756/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/50756/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50756"
},
{
"trust": 0.1,
"url": "http://www.gentoo.org/security/en/glsa/glsa-201209-15.xml"
},
{
"trust": 0.1,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-011.html"
},
{
"trust": 0.1,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-010.html"
},
{
"trust": 0.1,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-013.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50687"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/50687/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/50687/"
}
],
"sources": [
{
"db": "BID",
"id": "55351"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004020"
},
{
"db": "PACKETSTORM",
"id": "116096"
},
{
"db": "PACKETSTORM",
"id": "116914"
},
{
"db": "PACKETSTORM",
"id": "116960"
},
{
"db": "PACKETSTORM",
"id": "116896"
},
{
"db": "PACKETSTORM",
"id": "116646"
},
{
"db": "PACKETSTORM",
"id": "116705"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-683"
},
{
"db": "NVD",
"id": "CVE-2012-2186"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "55351"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004020"
},
{
"db": "PACKETSTORM",
"id": "116096"
},
{
"db": "PACKETSTORM",
"id": "116914"
},
{
"db": "PACKETSTORM",
"id": "116960"
},
{
"db": "PACKETSTORM",
"id": "116896"
},
{
"db": "PACKETSTORM",
"id": "116646"
},
{
"db": "PACKETSTORM",
"id": "116705"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-683"
},
{
"db": "NVD",
"id": "CVE-2012-2186"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-08-30T00:00:00",
"db": "BID",
"id": "55351"
},
{
"date": "2012-09-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-004020"
},
{
"date": "2012-08-30T21:46:42",
"db": "PACKETSTORM",
"id": "116096"
},
{
"date": "2012-09-27T00:09:12",
"db": "PACKETSTORM",
"id": "116914"
},
{
"date": "2012-09-28T03:46:47",
"db": "PACKETSTORM",
"id": "116960"
},
{
"date": "2012-09-26T22:17:20",
"db": "PACKETSTORM",
"id": "116896"
},
{
"date": "2012-09-19T07:22:56",
"db": "PACKETSTORM",
"id": "116646"
},
{
"date": "2012-09-19T10:31:08",
"db": "PACKETSTORM",
"id": "116705"
},
{
"date": "2012-08-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201208-683"
},
{
"date": "2012-08-31T14:55:00.950000",
"db": "NVD",
"id": "CVE-2012-2186"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-04-13T22:13:00",
"db": "BID",
"id": "55351"
},
{
"date": "2012-11-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-004020"
},
{
"date": "2012-09-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201208-683"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-2186"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "116096"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-683"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Asterisk Product of main/manager.c Vulnerable to arbitrary command execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004020"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Access Validation Error",
"sources": [
{
"db": "BID",
"id": "55351"
}
],
"trust": 0.3
}
}
VAR-201206-0140
Vulnerability from variot - Updated: 2025-04-11 21:48chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by closing a connection in off-hook mode. Asterisk is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to trigger a NULL-pointer dereference and cause a system crash, denying service to legitimate users. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201206-05
http://security.gentoo.org/
Severity: Normal Title: Asterisk: Multiple vulnerabilities Date: June 21, 2012 Bugs: #413353, #418189, #418191 ID: 201206-05
Synopsis
Multiple vulnerabilities in Asterisk might allow remote attackers to execute arbitrary code.
Background
Asterisk is an open source telephony engine and toolkit.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/asterisk < 1.8.12.1 >= 1.8.12.1
Description
Multiple vulnerabilities have been found in Asterisk:
- An error in manager.c allows shell access through the MixMonitor application, GetVar, or Status (CVE-2012-2414).
- An error in chan_skinny.c could cause a heap-based buffer overflow (CVE-2012-2415).
- An error in chan_sip.c prevents Asterisk from checking if a channel exists before connected line updates (CVE-2012-2416).
- An error in chan_iax2.c may cause an invalid pointer to be called (CVE-2012-2947).
- chan_skinny.c contains a NULL pointer dereference (CVE-2012-2948).
Impact
A remote attacker could execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
Workaround
There is no known workaround at this time.
Resolution
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.12.1"
References
[ 1 ] CVE-2012-2414 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2414 [ 2 ] CVE-2012-2415 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2415 [ 3 ] CVE-2012-2416 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2416 [ 4 ] CVE-2012-2947 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2947 [ 5 ] CVE-2012-2948 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2948
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201206-05.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. When an SCCP client
closes its connection to the server, a pointer in a
structure is set to Null. If the client was not in the
on-hook state at the time the connection was closed, this
pointer is later dereferenced. "Off hook") to crash
the server. Successful exploitation of this vulnerability
would result in termination of the server, causing denial
of service to legitimate users."
Resolution The pointer to the device in the structure is now checked
before it is dereferenced in the channel event callbacks and
message handling functions.
Affected Versions
Product Release Series
Asterisk Open Source 1.8.x All Versions
Asterisk Open Source 10.x All Versions
Certified Asterisk 1.8.11-cert 1.8.11-cert1
Corrected In
Product Release
Asterisk Open Source 1.8.12.1, 10.4.1
Certified Asterisk 1.8.11-cert2
Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2012-008-1.8.diff v1.8
http://downloads.asterisk.org/pub/security/AST-2012-008-10.diff v10
http://downloads.asterisk.org/pub/security/AST-2012-008-1.8.11-cert.diff v1.8.11-cert
Links https://issues.asterisk.org/jira/browse/ASTERISK-19905
Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2012-008.pdf and
http://downloads.digium.com/pub/security/AST-2012-008.html
Revision History
Date Editor Revisions Made
05/25/2012 Matt Jordan Initial Release
Asterisk Project Security Advisory - AST-2012-008
Copyright (c) 2012 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.
Full-Disclosure - We believe in it.
In addition, it was discovered that Asterisk does not set the alwaysauthreject option by default in the SIP channel driver. This allows remote attackers to observe a difference in response behavior and check for the presence of account names. (CVE-2011-2666) System administrators concerned by this user enumerating vulnerability should enable the alwaysauthreject option in the configuration. We do not plan to change the default setting in the stable version (Asterisk 1.6) in order to preserve backwards compatibility.
For the testing distribution (wheezy) and the unstable distribution (sid), this problem has been fixed in version 1:1.8.13.0~dfsg-1.
We recommend that you upgrade your asterisk packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBAgAGBQJP15u9AAoJEL97/wQC1SS+Pu0H/0ZPFRSNpL+hJKd7b5FGF6al BZSp51eAC0d2mEFWMml4DAvx6u1gMPzrO9PPNgsEc6gxNyD4Stj+rF54h6X5i5NR ZSlyeQTQ292J18+LdANYWwxQJyzNNthNmYL/2AiR6z2BRnD3ZqHiPbWGv0FV4Vyw rT8fZ7ujp7CQlFGwcqjPxUzBqEq5U2raN2K9BoP6zpu8mHf9WzcmL4KZR/wJxMkf 04McrMttF++gM3atFSSXCWC5Bpj8q0xpr3YIv0dI8+fWPFpevNX2MBM+diS06iNc PUWfCPTy2Psl46dC3J+JeF8TPWE/HCmV98DD54DEv0R1tPUmNm362dtfiutiBbQ= =Wy1e -----END PGP SIGNATURE-----
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: Asterisk Two Denial of Service Vulnerabilities
SECUNIA ADVISORY ID: SA49303
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49303/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49303
RELEASE DATE: 2012-05-30
DISCUSS ADVISORY: http://secunia.com/advisories/49303/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/49303/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49303
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Two vulnerabilities have been reported in Asterisk, which can be exploited by malicious people to cause a DoS (Denial of Service).
1) An error in IAX2 channel driver within the "handle_request_update()" function (channels/chan_sip.c) when placing an established call on hold can be exploited to cause a crash via specially crafted packets.
Successful exploitation of this vulnerability requires that the setting mohinterpret=passthrough is set and that the call is placed on hold without a suggested music-on-hold class name.
2) An error in SCCP (Skinny) channel driver (channels/chan_skinny.c) when handling termination of a client's connection can be exploited to cause a crash by closing a connection to the server in certain call states.
The vulnerabilities are reported in versions 1.8.11-cert prior to 1.8.11-cert2, 1.8.x prior to 1.8.12.1, and 10.x prior to 10.4.1.
SOLUTION: Update to a fixed version.
Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) mgrobecker 2) Christoph Hebeisen
ORIGINAL ADVISORY: http://downloads.asterisk.org/pub/security/AST-2012-007.html http://downloads.asterisk.org/pub/security/AST-2012-008.html
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201206-0140",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "open source",
"scope": "eq",
"trust": 1.6,
"vendor": "asterisk",
"version": "10.0.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.6,
"vendor": "asterisk",
"version": "10.1.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.6,
"vendor": "asterisk",
"version": "10.2.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.1"
},
{
"model": "asterisk",
"scope": "lte",
"trust": 1.0,
"vendor": "sangoma",
"version": "10.4.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.6.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.3.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.11.0"
},
{
"model": "certified asterisk",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.11"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.3"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.10.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.7.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.2"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.4.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.5.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.8.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.12.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.5"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.9.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "10.3"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.0"
},
{
"model": "open source",
"scope": "eq",
"trust": 1.0,
"vendor": "asterisk",
"version": "1.8.12"
},
{
"model": "asterisk",
"scope": "lte",
"trust": 1.0,
"vendor": "sangoma",
"version": "1.8.12.0"
},
{
"model": "asterisk open source",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "1.8.x"
},
{
"model": "certified asterisk",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "1.8.11-cert"
},
{
"model": "certified asterisk",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "1.8.11-cert2"
},
{
"model": "asterisk open source",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "1.8.12.1"
},
{
"model": "asterisk open source",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "10.4.1"
},
{
"model": "asterisk open source",
"scope": "lt",
"trust": 0.8,
"vendor": "digium",
"version": "10.x"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "certified asterisk 1.8.11-cert1",
"scope": null,
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "10.0.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "10.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.82"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.42"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.41"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.24"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "10.3.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "10.3.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "10.2.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "10.2.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.7.2"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.7.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.4.4"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.4.3"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.3.3"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.3.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.2.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.11.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.11.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.10.1"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.10.0"
},
{
"model": "asterisk",
"scope": "eq",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.1.2"
},
{
"model": "certified asterisk 1.8.11-cert2",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": null
},
{
"model": "asterisk",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": "10.4.1"
},
{
"model": "asterisk",
"scope": "ne",
"trust": 0.3,
"vendor": "asterisk",
"version": "1.8.12.1"
}
],
"sources": [
{
"db": "BID",
"id": "53723"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002590"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-525"
},
{
"db": "NVD",
"id": "CVE-2012-2948"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:digium:open_source",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:digium:certified_asterisk",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002590"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Christoph Hebeisen",
"sources": [
{
"db": "BID",
"id": "53723"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-525"
}
],
"trust": 0.9
},
"cve": "CVE-2012-2948",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.0,
"id": "CVE-2012-2948",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-2948",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2012-2948",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201205-525",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002590"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-525"
},
{
"db": "NVD",
"id": "CVE-2012-2948"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by closing a connection in off-hook mode. Asterisk is prone to a remote denial-of-service vulnerability. \nAttackers can exploit this issue to trigger a NULL-pointer dereference and cause a system crash, denying service to legitimate users. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201206-05\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: Asterisk: Multiple vulnerabilities\n Date: June 21, 2012\n Bugs: #413353, #418189, #418191\n ID: 201206-05\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities in Asterisk might allow remote attackers to\nexecute arbitrary code. \n\nBackground\n==========\n\nAsterisk is an open source telephony engine and toolkit. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 net-misc/asterisk \u003c 1.8.12.1 \u003e= 1.8.12.1\n\nDescription\n===========\n\nMultiple vulnerabilities have been found in Asterisk:\n\n* An error in manager.c allows shell access through the MixMonitor\n application, GetVar, or Status (CVE-2012-2414). \n* An error in chan_skinny.c could cause a heap-based buffer overflow\n (CVE-2012-2415). \n* An error in chan_sip.c prevents Asterisk from checking if a channel\n exists before connected line updates (CVE-2012-2416). \n* An error in chan_iax2.c may cause an invalid pointer to be called\n (CVE-2012-2947). \n* chan_skinny.c contains a NULL pointer dereference (CVE-2012-2948). \n\nImpact\n======\n\nA remote attacker could execute arbitrary code with the privileges of\nthe process or cause a Denial of Service condition. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Asterisk users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-misc/asterisk-1.8.12.1\"\n\nReferences\n==========\n\n[ 1 ] CVE-2012-2414\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2414\n[ 2 ] CVE-2012-2415\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2415\n[ 3 ] CVE-2012-2416\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2416\n[ 4 ] CVE-2012-2947\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2947\n[ 5 ] CVE-2012-2948\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2948\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201206-05.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2012 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. When an SCCP client \n closes its connection to the server, a pointer in a \n structure is set to Null. If the client was not in the \n on-hook state at the time the connection was closed, this \n pointer is later dereferenced. \"Off hook\") to crash \n the server. Successful exploitation of this vulnerability \n would result in termination of the server, causing denial \n of service to legitimate users.\" \n\n Resolution The pointer to the device in the structure is now checked \n before it is dereferenced in the channel event callbacks and \n message handling functions. \n\n Affected Versions\n Product Release Series \n Asterisk Open Source 1.8.x All Versions \n Asterisk Open Source 10.x All Versions \n Certified Asterisk 1.8.11-cert 1.8.11-cert1 \n\n Corrected In\n Product Release \n Asterisk Open Source 1.8.12.1, 10.4.1 \n Certified Asterisk 1.8.11-cert2 \n\n Patches \n SVN URL Revision \nhttp://downloads.asterisk.org/pub/security/AST-2012-008-1.8.diff v1.8 \nhttp://downloads.asterisk.org/pub/security/AST-2012-008-10.diff v10 \nhttp://downloads.asterisk.org/pub/security/AST-2012-008-1.8.11-cert.diff v1.8.11-cert \n\n Links https://issues.asterisk.org/jira/browse/ASTERISK-19905 \n\n Asterisk Project Security Advisories are posted at \n http://www.asterisk.org/security \n \n This document may be superseded by later versions; if so, the latest \n version will be posted at \n http://downloads.digium.com/pub/security/AST-2012-008.pdf and \n http://downloads.digium.com/pub/security/AST-2012-008.html \n\n Revision History\n Date Editor Revisions Made \n 05/25/2012 Matt Jordan Initial Release \n\n Asterisk Project Security Advisory - AST-2012-008\n Copyright (c) 2012 Digium, Inc. All Rights Reserved. \n Permission is hereby granted to distribute and publish this advisory in its\n original, unaltered form. \n\n_______________________________________________\nFull-Disclosure - We believe in it. \n\nIn addition, it was discovered that Asterisk does not set the\nalwaysauthreject option by default in the SIP channel driver. This\nallows remote attackers to observe a difference in response behavior\nand check for the presence of account names. (CVE-2011-2666) System\nadministrators concerned by this user enumerating vulnerability should\nenable the alwaysauthreject option in the configuration. We do not\nplan to change the default setting in the stable version\n(Asterisk 1.6) in order to preserve backwards compatibility. \n\nFor the testing distribution (wheezy) and the unstable distribution\n(sid), this problem has been fixed in version 1:1.8.13.0~dfsg-1. \n\nWe recommend that you upgrade your asterisk packages. \n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.10 (GNU/Linux)\n\niQEcBAEBAgAGBQJP15u9AAoJEL97/wQC1SS+Pu0H/0ZPFRSNpL+hJKd7b5FGF6al\nBZSp51eAC0d2mEFWMml4DAvx6u1gMPzrO9PPNgsEc6gxNyD4Stj+rF54h6X5i5NR\nZSlyeQTQ292J18+LdANYWwxQJyzNNthNmYL/2AiR6z2BRnD3ZqHiPbWGv0FV4Vyw\nrT8fZ7ujp7CQlFGwcqjPxUzBqEq5U2raN2K9BoP6zpu8mHf9WzcmL4KZR/wJxMkf\n04McrMttF++gM3atFSSXCWC5Bpj8q0xpr3YIv0dI8+fWPFpevNX2MBM+diS06iNc\nPUWfCPTy2Psl46dC3J+JeF8TPWE/HCmV98DD54DEv0R1tPUmNm362dtfiutiBbQ=\n=Wy1e\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nAsterisk Two Denial of Service Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA49303\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/49303/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49303\n\nRELEASE DATE:\n2012-05-30\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/49303/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/49303/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49303\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nTwo vulnerabilities have been reported in Asterisk, which can be\nexploited by malicious people to cause a DoS (Denial of Service). \n\n1) An error in IAX2 channel driver within the\n\"handle_request_update()\" function (channels/chan_sip.c) when placing\nan established call on hold can be exploited to cause a crash via\nspecially crafted packets. \n\nSuccessful exploitation of this vulnerability requires that the\nsetting mohinterpret=passthrough is set and that the call is placed\non hold without a suggested music-on-hold class name. \n\n2) An error in SCCP (Skinny) channel driver (channels/chan_skinny.c)\nwhen handling termination of a client\u0027s connection can be exploited\nto cause a crash by closing a connection to the server in certain\ncall states. \n\nThe vulnerabilities are reported in versions 1.8.11-cert prior to\n1.8.11-cert2, 1.8.x prior to 1.8.12.1, and 10.x prior to 10.4.1. \n\nSOLUTION:\nUpdate to a fixed version. \n\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n1) mgrobecker\n2) Christoph Hebeisen\n\nORIGINAL ADVISORY:\nhttp://downloads.asterisk.org/pub/security/AST-2012-007.html\nhttp://downloads.asterisk.org/pub/security/AST-2012-008.html\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-2948"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002590"
},
{
"db": "BID",
"id": "53723"
},
{
"db": "PACKETSTORM",
"id": "113979"
},
{
"db": "PACKETSTORM",
"id": "113113"
},
{
"db": "PACKETSTORM",
"id": "113546"
},
{
"db": "PACKETSTORM",
"id": "113124"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-2948",
"trust": 3.0
},
{
"db": "BID",
"id": "53723",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "49303",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1027103",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002590",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201205-525",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "113979",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "113113",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "113546",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "113124",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "53723"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002590"
},
{
"db": "PACKETSTORM",
"id": "113979"
},
{
"db": "PACKETSTORM",
"id": "113113"
},
{
"db": "PACKETSTORM",
"id": "113546"
},
{
"db": "PACKETSTORM",
"id": "113124"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-525"
},
{
"db": "NVD",
"id": "CVE-2012-2948"
}
]
},
"id": "VAR-201206-0140",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.348297215
},
"last_update_date": "2025-04-11T21:48:51.514000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "AST-2012-008",
"trust": 0.8,
"url": "http://downloads.asterisk.org/pub/security/AST-2012-008.html"
},
{
"title": "DSA-2493",
"trust": 0.8,
"url": "http://www.debian.org/security/2012/dsa-2493"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002590"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002590"
},
{
"db": "NVD",
"id": "CVE-2012-2948"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-008.html"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/53723"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/49303"
},
{
"trust": 1.0,
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-05/0145.html"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75937"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id?1027103"
},
{
"trust": 1.0,
"url": "http://www.debian.org/security/2012/dsa-2493"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2948"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2948"
},
{
"trust": 0.3,
"url": "http://www.asterisk.org/"
},
{
"trust": 0.3,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-008.pdf"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2948"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2947"
},
{
"trust": 0.2,
"url": "http://secunia.com/"
},
{
"trust": 0.2,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2948"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2415"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-201206-05.xml"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2414"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2416"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2947"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2414"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2416"
},
{
"trust": 0.1,
"url": "http://www.asterisk.org/security"
},
{
"trust": 0.1,
"url": "https://issues.asterisk.org/jira/browse/asterisk-19905"
},
{
"trust": 0.1,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-008-1.8.diff"
},
{
"trust": 0.1,
"url": "http://downloads.digium.com/pub/security/ast-2012-008.html"
},
{
"trust": 0.1,
"url": "http://downloads.digium.com/pub/security/ast-2012-008.pdf"
},
{
"trust": 0.1,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-008-10.diff"
},
{
"trust": 0.1,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-008-1.8.11-cert.diff"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49303"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49303/"
},
{
"trust": 0.1,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://downloads.asterisk.org/pub/security/ast-2012-007.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49303/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "BID",
"id": "53723"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002590"
},
{
"db": "PACKETSTORM",
"id": "113979"
},
{
"db": "PACKETSTORM",
"id": "113113"
},
{
"db": "PACKETSTORM",
"id": "113546"
},
{
"db": "PACKETSTORM",
"id": "113124"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-525"
},
{
"db": "NVD",
"id": "CVE-2012-2948"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "53723"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002590"
},
{
"db": "PACKETSTORM",
"id": "113979"
},
{
"db": "PACKETSTORM",
"id": "113113"
},
{
"db": "PACKETSTORM",
"id": "113546"
},
{
"db": "PACKETSTORM",
"id": "113124"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-525"
},
{
"db": "NVD",
"id": "CVE-2012-2948"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-29T00:00:00",
"db": "BID",
"id": "53723"
},
{
"date": "2012-06-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002590"
},
{
"date": "2012-06-21T04:39:39",
"db": "PACKETSTORM",
"id": "113979"
},
{
"date": "2012-05-29T23:38:21",
"db": "PACKETSTORM",
"id": "113113"
},
{
"date": "2012-06-12T20:50:36",
"db": "PACKETSTORM",
"id": "113546"
},
{
"date": "2012-05-30T03:42:47",
"db": "PACKETSTORM",
"id": "113124"
},
{
"date": "2012-05-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-525"
},
{
"date": "2012-06-02T15:55:01.027000",
"db": "NVD",
"id": "CVE-2012-2948"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-06-22T00:10:00",
"db": "BID",
"id": "53723"
},
{
"date": "2012-06-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002590"
},
{
"date": "2012-06-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-525"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-2948"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "113979"
},
{
"db": "PACKETSTORM",
"id": "113113"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-525"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Certified Asterisk and Asterisk Open Source Service disruption in (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002590"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-525"
}
],
"trust": 0.6
}
}
VAR-202011-0887
Vulnerability from variot - Updated: 2024-11-23 22:11An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202011-0887",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "33"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.0"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "18.0"
},
{
"model": "certified asterisk",
"scope": "lte",
"trust": 1.0,
"vendor": "asterisk",
"version": "16.8.0"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "16.0"
},
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "13.37.1"
},
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "18.0.1"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "17.8.1"
},
{
"model": "asterisk",
"scope": "lt",
"trust": 1.0,
"vendor": "sangoma",
"version": "16.14.1"
},
{
"model": "asterisk",
"scope": "gte",
"trust": 1.0,
"vendor": "sangoma",
"version": "17.0"
},
{
"model": "asterisk open source",
"scope": null,
"trust": 0.8,
"vendor": "digium",
"version": null
},
{
"model": "certified asterisk",
"scope": "eq",
"trust": 0.8,
"vendor": "digium",
"version": "16.8-cert5"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-013387"
},
{
"db": "NVD",
"id": "CVE-2020-28242"
}
]
},
"cve": "CVE-2020-28242",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.0,
"id": "CVE-2020-28242",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.8,
"id": "CVE-2020-28242",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 6.5,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2020-28242",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2020-28242",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2020-28242",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202011-675",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-013387"
},
{
"db": "CNNVD",
"id": "CNNVD-202011-675"
},
{
"db": "NVD",
"id": "CVE-2020-28242"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-28242"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-013387"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-28242",
"trust": 2.4
},
{
"db": "JVNDB",
"id": "JVNDB-2020-013387",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202011-675",
"trust": 0.6
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-013387"
},
{
"db": "CNNVD",
"id": "CNNVD-202011-675"
},
{
"db": "NVD",
"id": "CVE-2020-28242"
}
]
},
"id": "VAR-202011-0887",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.348297215
},
"last_update_date": "2024-11-23T22:11:15.384000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "AST-2020-002",
"trust": 0.8,
"url": "http://downloads.asterisk.org/pub/security/AST-2020-002.html"
},
{
"title": "Digium Asterisk Open Source and Certified Asterisk Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=135266"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-013387"
},
{
"db": "CNNVD",
"id": "CNNVD-202011-675"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-674",
"trust": 1.0
},
{
"problemtype": "Inappropriate recursive control (CWE-674) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-013387"
},
{
"db": "NVD",
"id": "CVE-2020-28242"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://downloads.asterisk.org/pub/security/ast-2020-002.html"
},
{
"trust": 1.6,
"url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-28242"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/qus54qtqcykr36eiulyd544gxda644hb/"
},
{
"trust": 0.6,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/qus54qtqcykr36eiulyd544gxda644hb/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-013387"
},
{
"db": "CNNVD",
"id": "CNNVD-202011-675"
},
{
"db": "NVD",
"id": "CVE-2020-28242"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2020-013387"
},
{
"db": "CNNVD",
"id": "CNNVD-202011-675"
},
{
"db": "NVD",
"id": "CVE-2020-28242"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-06-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-013387"
},
{
"date": "2020-11-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202011-675"
},
{
"date": "2020-11-06T06:15:11.930000",
"db": "NVD",
"id": "CVE-2020-28242"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-06-29T08:35:00",
"db": "JVNDB",
"id": "JVNDB-2020-013387"
},
{
"date": "2022-04-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202011-675"
},
{
"date": "2024-11-21T05:22:30.340000",
"db": "NVD",
"id": "CVE-2020-28242"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202011-675"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Asterisk\u00a0Open\u00a0Source\u00a0 and \u00a0Certified\u00a0Asterisk\u00a0 Recursion control vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-013387"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202011-675"
}
],
"trust": 0.6
}
}
CERTFR-2025-AVI-0020
Vulnerability from certfr_avis - Published: 2025-01-10 - Updated: 2025-01-10
Une vulnérabilité a été découverte dans Asterisk. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | asterisk versions 22.1.x antérieures à 22.1.1 | ||
| Asterisk | Certified Asterisk | certified-asterisk versions antérieures à 18.9-cert13 | ||
| Asterisk | Asterisk | asterisk versions 21.6.x antérieures à 21.6.1 | ||
| Asterisk | Certified Asterisk | certified-asterisk versions 20.7.x antérieures à 20.7-cert4 | ||
| Asterisk | Asterisk | asterisk versions 20.11.x antérieures à 20.11.1 | ||
| Asterisk | Asterisk | asterisk versions antérieures à 18.26.1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "asterisk versions 22.1.x ant\u00e9rieures \u00e0 22.1.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "certified-asterisk versions ant\u00e9rieures \u00e0 18.9-cert13",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "asterisk versions 21.6.x ant\u00e9rieures \u00e0 21.6.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "certified-asterisk versions 20.7.x ant\u00e9rieures \u00e0 20.7-cert4",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "asterisk versions 20.11.x ant\u00e9rieures \u00e0 20.11.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "asterisk versions ant\u00e9rieures \u00e0 18.26.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-53566",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53566"
}
],
"initial_release_date": "2025-01-10T00:00:00",
"last_revision_date": "2025-01-10T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0020",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-01-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Asterisk. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans Asterisk",
"vendor_advisories": [
{
"published_at": "2025-01-09",
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk GHSA-33x6-fj46-6rfh",
"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-33x6-fj46-6rfh"
}
]
}
CERTFR-2024-AVI-0745
Vulnerability from certfr_avis - Published: 2024-09-06 - Updated: 2024-09-06
Une vulnérabilité a été découverte dans les produits Asterisk. Elle permet à un attaquant de provoquer un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk versions 20.x et antérieures à 20.9.3 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 18.x et antérieures à 18.9-cert12 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 20.x et antérieures à 20.7-cert3 | ||
| Asterisk | Asterisk | Asterisk versions 18.x et antérieures à 18.24.3 | ||
| Asterisk | Asterisk | Asterisk versions 21.x et antérieures à 21.4.3 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk versions 20.x et ant\u00e9rieures \u00e0 20.9.3",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 18.x et ant\u00e9rieures \u00e0 18.9-cert12",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 20.x et ant\u00e9rieures \u00e0 20.7-cert3",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk versions 18.x et ant\u00e9rieures \u00e0 18.24.3",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk versions 21.x et ant\u00e9rieures \u00e0 21.4.3",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-42491",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42491"
}
],
"initial_release_date": "2024-09-06T00:00:00",
"last_revision_date": "2024-09-06T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0745",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-09-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Asterisk. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits Asterisk",
"vendor_advisories": [
{
"published_at": "2024-09-05",
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk GHSA-v428-g3cw-7hv9",
"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-v428-g3cw-7hv9"
}
]
}
CERTFR-2023-AVI-1040
Vulnerability from certfr_avis - Published: 2023-12-18 - Updated: 2023-12-18
De multiples vulnérabilités ont été découvertes dans les produits Asterisk. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un problème de sécurité non spécifié par l'éditeur.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk Open Source versions 20.x.x antérieures à 20.5.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 21.0.x antérieures à 21.0.1 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 18.9-cert5 et antérieures | ||
| Asterisk | Asterisk | Asterisk Open Source versions antérieures à 18.20.1 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source versions 20.x.x ant\u00e9rieures \u00e0 20.5.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 21.0.x ant\u00e9rieures \u00e0 21.0.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 18.9-cert5 et ant\u00e9rieures",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions ant\u00e9rieures \u00e0 18.20.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-37457",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37457"
},
{
"name": "CVE-2023-49294",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49294"
},
{
"name": "CVE-2023-49786",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49786"
}
],
"initial_release_date": "2023-12-18T00:00:00",
"last_revision_date": "2023-12-18T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-1040",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-12-18T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Asterisk\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9\ndes donn\u00e9es et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk GHSA-98rc-4j27-74hh du 14 d\u00e9cembre 2023",
"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-98rc-4j27-74hh"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk GHSA-5743-x3p5-3rg7 du 14 d\u00e9cembre 2023",
"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-5743-x3p5-3rg7"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk GHSA-8857-hfmw-vg8f du 14 d\u00e9cembre 2023",
"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8f"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk GHSA-hxj9-xwr8-w8pq du 14 d\u00e9cembre 2023",
"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq"
}
]
}
CERTFR-2023-AVI-0521
Vulnerability from certfr_avis - Published: 2023-07-10 - Updated: 2023-07-10
Une vulnérabilité a été découverte dans Asterisk. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk open source versions 16.x antérieures à 16.30.1 | ||
| Asterisk | Asterisk | Asterisk open source versions 19.x antérieures à 19.8.1 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 18.9.x antérieures à Certified-18.9-cert5 | ||
| Asterisk | Asterisk | Asterisk open source versions 18.x antérieures à 18.18.1 | ||
| Asterisk | Asterisk | Asterisk open source versions 20.x antérieures à 20.3.1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk open source versions 16.x ant\u00e9rieures \u00e0 16.30.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk open source versions 19.x ant\u00e9rieures \u00e0 19.8.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 18.9.x ant\u00e9rieures \u00e0 Certified-18.9-cert5",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk open source versions 18.x ant\u00e9rieures \u00e0 18.18.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk open source versions 20.x ant\u00e9rieures \u00e0 20.3.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-23537",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23537"
}
],
"initial_release_date": "2023-07-10T00:00:00",
"last_revision_date": "2023-07-10T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0521",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-07-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans\u003cspan class=\"textit\"\u003e\nAsterisk\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0\nla confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk GHSA-4xjp-22g4-9fxm du 07 juillet 2023",
"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-4xjp-22g4-9fxm"
}
]
}
CERTFR-2022-AVI-1071
Vulnerability from certfr_avis - Published: 2022-12-02 - Updated: 2022-12-02
De multiples vulnérabilités ont été découvertes dans les produits Asterisk. Elles permettent à un attaquant de provoquer un déni de service à distance et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Certified Asterisk | Certified Asterisk versions 18.9.x antérieures à Certified-18.9-cert3 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 20.x antérieures à 20.0.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 16.x antérieures à 16.29.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 19.x antérieures à 19.7.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 18.x antérieures à 18.15.1 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Certified Asterisk versions 18.9.x ant\u00e9rieures \u00e0 Certified-18.9-cert3",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 20.x ant\u00e9rieures \u00e0 20.0.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 16.x ant\u00e9rieures \u00e0 16.29.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 19.x ant\u00e9rieures \u00e0 19.7.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 18.x ant\u00e9rieures \u00e0 18.15.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-42706",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42706"
},
{
"name": "CVE-2022-37325",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37325"
},
{
"name": "CVE-2022-42705",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42705"
}
],
"initial_release_date": "2022-12-02T00:00:00",
"last_revision_date": "2022-12-02T00:00:00",
"links": [],
"reference": "CERTFR-2022-AVI-1071",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-12-02T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nAsterisk. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de\nservice \u00e0 distance et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2022-007 du 30 novembre 2022",
"url": "https://downloads.asterisk.org/pub/security/AST-2022-007.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2022-008 du 30 novembre 2022",
"url": "https://downloads.asterisk.org/pub/security/AST-2022-008.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2022-009 du 30 novembre 2022",
"url": "https://downloads.asterisk.org/pub/security/AST-2022-009.html"
}
]
}
CERTFR-2021-AVI-569
Vulnerability from certfr_avis - Published: 2021-07-23 - Updated: 2021-07-23
De multiples vulnérabilités ont été découvertes dans les produits Asterisk. Elles permettent à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk Open Source versions 18.x antérieures à 18.5.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 16.x antérieures à 16.19.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 13.x antérieures à 13.38.3 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 17.x antérieures à 17.9.4 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 16.x antérieures à 16.8-cert10 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source versions 18.x ant\u00e9rieures \u00e0 18.5.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 16.x ant\u00e9rieures \u00e0 16.19.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 13.x ant\u00e9rieures \u00e0 13.38.3",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 17.x ant\u00e9rieures \u00e0 17.9.4",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 16.x ant\u00e9rieures \u00e0 16.8-cert10",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-32558",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32558"
},
{
"name": "CVE-2021-31878",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31878"
},
{
"name": "CVE-2021-32686",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32686"
}
],
"initial_release_date": "2021-07-23T00:00:00",
"last_revision_date": "2021-07-23T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-569",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-07-23T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nAsterisk. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de\nservice \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2021-007 du 6 avril 2021",
"url": "https://downloads.asterisk.org/pub/security/AST-2021-007.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2021-009 du 5 mai 2021",
"url": "https://downloads.asterisk.org/pub/security/AST-2021-009.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2021-008 du 13 avril 2021",
"url": "https://downloads.asterisk.org/pub/security/AST-2021-008.html"
}
]
}
CERTFR-2021-AVI-170
Vulnerability from certfr_avis - Published: 2021-03-05 - Updated: 2021-03-05
Une vulnérabilité a été découverte dans Asterisk. Elle permet à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk Open Source versions 18.x antérieures à 18.2.2 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 17.x antérieures à 17.9.3 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 16.x antérieures à 16.16.1 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 16.x antérieures à 16.8-cert7 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source versions 18.x ant\u00e9rieures \u00e0 18.2.2",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 17.x ant\u00e9rieures \u00e0 17.9.3",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 16.x ant\u00e9rieures \u00e0 16.16.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 16.x ant\u00e9rieures \u00e0 16.8-cert7",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-15297",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15297"
}
],
"initial_release_date": "2021-03-05T00:00:00",
"last_revision_date": "2021-03-05T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-170",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-03-05T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Asterisk. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk du 04 mars 2021",
"url": "https://downloads.asterisk.org/pub/security/AST-2021-006.html"
}
]
}
CERTFR-2021-AVI-136
Vulnerability from certfr_avis - Published: 2021-02-19 - Updated: 2021-02-19
De multiples vulnérabilités ont été découvertes dans Asterisk. Elles permettent à un attaquant de provoquer un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Certified Asterisk | Certified Asterisk versions 16.x antérieures à 16.8-cert6 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 18.x antérieures à 18.2.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 17.x antérieures à 17.9.2 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 13.x antérieures à 13.38.2 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 16.x antérieures à 16.16.1 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Certified Asterisk versions 16.x ant\u00e9rieures \u00e0 16.8-cert6",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 18.x ant\u00e9rieures \u00e0 18.2.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 17.x ant\u00e9rieures \u00e0 17.9.2",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 13.x ant\u00e9rieures \u00e0 13.38.2",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 16.x ant\u00e9rieures \u00e0 16.16.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-26712",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26712"
},
{
"name": "CVE-2021-26714",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26714"
},
{
"name": "CVE-2021-26717",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26717"
},
{
"name": "CVE-2020-35776",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35776"
},
{
"name": "CVE-2021-26906",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26906"
}
],
"initial_release_date": "2021-02-19T00:00:00",
"last_revision_date": "2021-02-19T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-136",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-02-19T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Asterisk. Elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2021-003 du 18 f\u00e9vrier 2021",
"url": "https://downloads.asterisk.org/pub/security/AST-2021-003.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2021-004 du 11 f\u00e9vrier 2021",
"url": "https://downloads.asterisk.org/pub/security/AST-2021-004.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2021-002 du 05 f\u00e9vrier 2021",
"url": "https://downloads.asterisk.org/pub/security/AST-2021-002.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2021-005 du 08 f\u00e9vrier 2021",
"url": "https://downloads.asterisk.org/pub/security/AST-2021-005.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2021-001 du 04 janvier 2021",
"url": "https://downloads.asterisk.org/pub/security/AST-2021-001.html"
}
]
}
CERTFR-2020-AVI-720
Vulnerability from certfr_avis - Published: 2020-11-09 - Updated: 2020-11-09
De multiples vulnérabilités ont été corrigées dans Asterisk. Elles permettent à un attaquant de provoquer un déni de service et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Certified Asterisk | Certified Asterisk versions 16.8 antérieures à 16.8-cert5 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 17.x antérieures à 17.8.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 16.x antérieures à 16.14.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 18.x antérieures à 18.0.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 13.x antérieures à 13.37.1 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Certified Asterisk versions 16.8 ant\u00e9rieures \u00e0 16.8-cert5",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 17.x ant\u00e9rieures \u00e0 17.8.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 16.x ant\u00e9rieures \u00e0 16.14.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 18.x ant\u00e9rieures \u00e0 18.0.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 13.x ant\u00e9rieures \u00e0 13.37.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-28327",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28327"
}
],
"initial_release_date": "2020-11-09T00:00:00",
"last_revision_date": "2020-11-09T00:00:00",
"links": [],
"reference": "CERTFR-2020-AVI-720",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-11-09T00:00:00.000000"
},
{
"description": "Correction faute d\u0027orthographe",
"revision_date": "2020-11-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans Asterisk. Elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2020-001 du 05 novembre 2020",
"url": "http://downloads.asterisk.org/pub/security/AST-2020-001.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2020-002 du 05 novembre 2020",
"url": "http://downloads.asterisk.org/pub/security/AST-2020-002.html"
}
]
}
CERTFR-2019-AVI-587
Vulnerability from certfr_avis - Published: 2019-11-22 - Updated: 2019-11-22
De multiples vulnérabilités ont été découvertes dans Asterisk. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk Open Source versions antérieures à 13.29.2 | ||
| Asterisk | Asterisk | Asterisk Open Source versions antérieures à 16.6.2 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions antérieures à 13.21-cert5 | ||
| Asterisk | Asterisk | Asterisk Open Source versions antérieures à 17.0.1 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source versions ant\u00e9rieures \u00e0 13.29.2",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions ant\u00e9rieures \u00e0 16.6.2",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions ant\u00e9rieures \u00e0 13.21-cert5",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions ant\u00e9rieures \u00e0 17.0.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-18976",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18976"
},
{
"name": "CVE-2019-18790",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18790"
},
{
"name": "CVE-2019-18610",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18610"
}
],
"initial_release_date": "2019-11-22T00:00:00",
"last_revision_date": "2019-11-22T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-587",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-11-22T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Asterisk. Elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2019-007 du 21 novembre 2019",
"url": "http://downloads.asterisk.org/pub/security/AST-2019-007.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2019-006 du 21 novembre 2019",
"url": "http://downloads.asterisk.org/pub/security/AST-2019-006.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2019-008 du 21 novembre 2019",
"url": "http://downloads.asterisk.org/pub/security/AST-2019-008.html"
}
]
}
CERTFR-2019-AVI-329
Vulnerability from certfr_avis - Published: 2019-07-12 - Updated: 2019-07-12
De multiples vulnérabilités ont été découvertes dans Asterisk. Elles permettent à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Certified Asterisk | Certified Asterisk versions antérieures à 13.21-cert4 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 16.x antérieures à 16.4.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 15.x antérieures à 15.7.3 | ||
| Asterisk | Asterisk | Asterisk Open Source versions antérieures à 13.27.1 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Certified Asterisk versions ant\u00e9rieures \u00e0 13.21-cert4",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 16.x ant\u00e9rieures \u00e0 16.4.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 15.x ant\u00e9rieures \u00e0 15.7.3",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions ant\u00e9rieures \u00e0 13.27.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-13161",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13161"
},
{
"name": "CVE-2019-12827",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12827"
}
],
"initial_release_date": "2019-07-12T00:00:00",
"last_revision_date": "2019-07-12T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-329",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-07-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Asterisk. Elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2019-002 du 11 juillet 2019",
"url": "http://downloads.asterisk.org/pub/security/AST-2019-002.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2019-003 du 11 juillet 2019",
"url": "http://downloads.asterisk.org/pub/security/AST-2019-003.html"
}
]
}
CERTFR-2018-AVI-452
Vulnerability from certfr_avis - Published: 2018-09-24 - Updated: 2018-09-24
Une vulnérabilité a été découverte dans Asterisk. Elle permet à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source 15.x toutes versions",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk 13.21 toutes versions",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source 13.x toutes versions",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source 14.x toutes versions",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-17281",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17281"
}
],
"initial_release_date": "2018-09-24T00:00:00",
"last_revision_date": "2018-09-24T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-452",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-09-24T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Asterisk. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2018-009 du 20 septembre 2018",
"url": "http://downloads.asterisk.org/pub/security/AST-2018-009.html"
}
]
}
CERTFR-2018-AVI-276
Vulnerability from certfr_avis - Published: 2018-06-12 - Updated: 2018-06-12
De multiples vulnérabilités ont été découvertes dans Asterisk . Elles permettent à un attaquant de provoquer un déni de service à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk Open Source versions 14.x antérieures à 14.7.7 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 15.x antérieures à 15.4.1 | ||
| Asterisk | Certified Asterisk | Certified Asterisk version 13.21 antérieure à 13.21-cert2 | ||
| Asterisk | Certified Asterisk | Certified Asterisk version 13.18 antérieure à 13.18-cert4 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 13.x antérieures à 13.21.1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source versions 14.x ant\u00e9rieures \u00e0 14.7.7",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 15.x ant\u00e9rieures \u00e0 15.4.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk version 13.21 ant\u00e9rieure \u00e0 13.21-cert2",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk version 13.18 ant\u00e9rieure \u00e0 13.18-cert4",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 13.x ant\u00e9rieures \u00e0 13.21.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [],
"initial_release_date": "2018-06-12T00:00:00",
"last_revision_date": "2018-06-12T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-276",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-06-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Asterisk . Elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk du 11 juin 2018",
"url": "http://downloads.asterisk.org/pub/security/AST-2018-008.html"
}
]
}
CERTFR-2018-AVI-097
Vulnerability from certfr_avis - Published: 2018-02-22 - Updated: 2018-02-22
De multiples vulnérabilités ont été découvertes dans Asterisk . Elles permettent à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | N/A | Asterix Open Source versions 13.x antérieures à 13.19.2 | ||
| Asterisk | N/A | Asterix Open Source versions 15.x antérieures à 15.2.2 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions antérieures à 13.18-cert3 | ||
| Asterisk | N/A | Asterix Open Source versions 14.x antérieures à 14.7.6 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterix Open Source versions 13.x ant\u00e9rieures \u00e0 13.19.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterix Open Source versions 15.x ant\u00e9rieures \u00e0 15.2.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions ant\u00e9rieures \u00e0 13.18-cert3",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterix Open Source versions 14.x ant\u00e9rieures \u00e0 14.7.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-7284",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7284"
},
{
"name": "CVE-2018-7286",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7286"
},
{
"name": "CVE-2018-7287",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7287"
}
],
"initial_release_date": "2018-02-22T00:00:00",
"last_revision_date": "2018-02-22T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-097",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-02-22T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Asterisk . Elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2018-002 du 21 f\u00e9vrier 2018",
"url": "http://downloads.asterisk.org/pub/security/AST-2018-002.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2018-006 du 21 f\u00e9vrier 2018",
"url": "http://downloads.asterisk.org/pub/security/AST-2018-006.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2018-004 du 21 f\u00e9vrier 2018",
"url": "http://downloads.asterisk.org/pub/security/AST-2018-004.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2018-005 du 21 f\u00e9vrier 2018",
"url": "http://downloads.asterisk.org/pub/security/AST-2018-005.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2018-003 du 21 f\u00e9vrier 2018",
"url": "http://downloads.asterisk.org/pub/security/AST-2018-003.html"
}
]
}
CERTFR-2017-AVI-483
Vulnerability from certfr_avis - Published: 2017-12-26 - Updated: 2017-12-26
Une vulnérabilité a été découverte dans Asterisk . Elle permet à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Certified Asterisk 13.18 toutes versions",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source 15.x toutes versions",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source 13.x toutes versions",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source 14.x toutes versions",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-17850",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17850"
}
],
"initial_release_date": "2017-12-26T00:00:00",
"last_revision_date": "2017-12-26T00:00:00",
"links": [],
"reference": "CERTFR-2017-AVI-483",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2017-12-26T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Asterisk . Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-014 du 22 d\u00e9cembre 2017",
"url": "http://downloads.asterisk.org/pub/security/AST-2017-014.html"
}
]
}
CERTFR-2017-AVI-473
Vulnerability from certfr_avis - Published: 2017-12-14 - Updated: 2017-12-14
Une vulnérabilité a été découverte dans Asterisk . Elle permet à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk Open Source versions 15.x antérieures à 15.1.4 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 14.x antérieures à 14.7.4 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 13.13 antérieures à 13.13-cert9 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 13.x antérieures à 13.18.4 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source versions 15.x ant\u00e9rieures \u00e0 15.1.4",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 14.x ant\u00e9rieures \u00e0 14.7.4",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 13.13 ant\u00e9rieures \u00e0 13.13-cert9",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 13.x ant\u00e9rieures \u00e0 13.18.4",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [],
"initial_release_date": "2017-12-14T00:00:00",
"last_revision_date": "2017-12-14T00:00:00",
"links": [],
"reference": "CERTFR-2017-AVI-473",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2017-12-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Asterisk . Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-012 du 13 d\u00e9cembre 2017",
"url": "http://downloads.asterisk.org/pub/security/AST-2017-012.html"
}
]
}
CERTFR-2017-AVI-401
Vulnerability from certfr_avis - Published: 2017-11-09 - Updated: 2017-11-09
De multiples vulnérabilités ont été découvertes dans Asterisk . Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, un déni de service à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk Open Source versions 13.x antérieures à 13.18.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 15.x antérieures à 15.1.1 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 14.x antérieures à 14.7.1 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 13.13 antérieures à 13.13-cert7 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source versions 13.x ant\u00e9rieures \u00e0 13.18.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 15.x ant\u00e9rieures \u00e0 15.1.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 14.x ant\u00e9rieures \u00e0 14.7.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 13.13 ant\u00e9rieures \u00e0 13.13-cert7",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [],
"initial_release_date": "2017-11-09T00:00:00",
"last_revision_date": "2017-11-09T00:00:00",
"links": [],
"reference": "CERTFR-2017-AVI-401",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2017-11-09T00:00:00.000000"
},
{
"description": "Version initiale",
"revision_date": "2017-11-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Asterisk . Elles\npermettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0\nla confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-010 du 8 novembre 2017",
"url": "http://downloads.asterisk.org/pub/security/AST-2017-010.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-009 du 8 novembre 2017",
"url": "http://downloads.asterisk.org/pub/security/AST-2017-009.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-011 du 8 novembre 2017",
"url": "http://downloads.asterisk.org/pub/security/AST-2017-011.html"
}
]
}
CERTFR-2017-AVI-313
Vulnerability from certfr_avis - Published: 2017-09-20 - Updated: 2017-09-20
Une vulnérabilité a été corrigée dans Asterisk. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Certified Asterisk | Certified Asterisk versions 11.6 antérieures à 11.6-cert18 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 13.13 antérieures à 13.13-cert6 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 11.x antérieures à 11.25.3 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 14.x antérieures à 14.6.2 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 13.x antérieures à 13.17.2 |
References
| Title | Publication Time | Tags | |
|---|---|---|---|
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Certified Asterisk versions 11.6 ant\u00e9rieures \u00e0 11.6-cert18",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 13.13 ant\u00e9rieures \u00e0 13.13-cert6",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 11.x ant\u00e9rieures \u00e0 11.25.3",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 14.x ant\u00e9rieures \u00e0 14.6.2",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 13.x ant\u00e9rieures \u00e0 13.17.2",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-14099",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14099"
}
],
"initial_release_date": "2017-09-20T00:00:00",
"last_revision_date": "2017-09-20T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-008 du 19 septembre 2017",
"url": "http://downloads.asterisk.org/pub/security/AST-2017-008.html"
}
],
"reference": "CERTFR-2017-AVI-313",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2017-09-20T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan\nclass=\"textit\"\u003eAsterisk\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-008 du 19 septembre 2017",
"url": null
}
]
}
CERTFR-2017-AVI-281
Vulnerability from certfr_avis - Published: 2017-09-01 - Updated: 2017-09-01
De multiples vulnérabilités ont été corrigées dans Asterisk. Elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Certified Asterisk | Certified Asterisk versions antérieures à 11.6-cert17 et 13.13-cert5 | ||
| Asterisk | Asterisk | Asterisk Open Source versions antérieures à 11.25.2, 13.17.1 et 14.6.1 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Certified Asterisk versions ant\u00e9rieures \u00e0 11.6-cert17 et 13.13-cert5",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions ant\u00e9rieures \u00e0 11.25.2, 13.17.1 et 14.6.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-14099",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14099"
},
{
"name": "CVE-2017-14100",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14100"
},
{
"name": "CVE-2017-14098",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14098"
}
],
"initial_release_date": "2017-09-01T00:00:00",
"last_revision_date": "2017-09-01T00:00:00",
"links": [],
"reference": "CERTFR-2017-AVI-281",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2017-09-01T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eAsterisk\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire, un d\u00e9ni de service \u00e0\ndistance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-006 du 31 ao\u00fbt 2017",
"url": "https://downloads.asterisk.org/pub/security/AST-2017-006.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-007 du 31 ao\u00fbt 2017",
"url": "https://downloads.asterisk.org/pub/security/AST-2017-007.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-005 du 31 ao\u00fbt 2017",
"url": "https://downloads.asterisk.org/pub/security/AST-2017-005.html"
}
]
}
CERTFR-2017-AVI-102
Vulnerability from certfr_avis - Published: 2017-04-05 - Updated: 2017-04-05
Une vulnérabilité a été corrigée dans Asterisk. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source versions 13.x ant\u00e9rieures \u00e0 13.14.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 14.x ant\u00e9rieures \u00e0 14.3.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 13.13 ant\u00e9rieures \u00e0 13.13-cert3",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [],
"initial_release_date": "2017-04-05T00:00:00",
"last_revision_date": "2017-04-05T00:00:00",
"links": [],
"reference": "CERTFR-2017-AVI-102",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2017-04-05T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan\nclass=\"textit\"\u003eAsterisk\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2017-001 du 04 avril 2017",
"url": "http://downloads.asterisk.org/pub/security/AST-2017-001.html"
}
]
}
CERTFR-2016-AVI-403
Vulnerability from certfr_avis - Published: 2016-12-09 - Updated: 2016-12-09
De multiples vulnérabilités ont été corrigées dans Asterisk. Elles permettent à un attaquant de provoquer un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Certified Asterisk | Certified Asterisk versions 13.8 antérieures à 13.8-cert4 | ||
| Asterisk | Asterisk | Asterisk Open Source toutes les versions 13.x antérieures à 13.13.1 | ||
| Asterisk | Asterisk | Asterisk Open Source toutes les versions 11.x antérieures à 11.25.1 | ||
| Asterisk | Asterisk | Asterisk Open Source toutes les versions 14.x antérieures à 14.2.1 |
References
| Title | Publication Time | Tags | |
|---|---|---|---|
|
|
|||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Certified Asterisk versions 13.8 ant\u00e9rieures \u00e0 13.8-cert4",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source toutes les versions 13.x ant\u00e9rieures \u00e0 13.13.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source toutes les versions 11.x ant\u00e9rieures \u00e0 11.25.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source toutes les versions 14.x ant\u00e9rieures \u00e0 14.2.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [],
"initial_release_date": "2016-12-09T00:00:00",
"last_revision_date": "2016-12-09T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-008 du 08 d\u00e9cembre 2016",
"url": "http://downloads.asterisk.org/pub/security/AST-2016-008.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk ASTERISK-2016-009du 08 d\u00e9cembre 2016",
"url": "http://downloads.asterisk.org/pub/security/AST-2016-009.html"
}
],
"reference": "CERTFR-2016-AVI-403",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2016-12-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eAsterisk\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer un d\u00e9ni de service \u00e0 distance et un contournement de la\npolitique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-009 du 08 d\u00e9cembre 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-008 du 08 d\u00e9cembre 2016",
"url": null
}
]
}
CERTFR-2016-AVI-302
Vulnerability from certfr_avis - Published: 2016-09-09 - Updated: 2016-09-09
De multiples vulnérabilités ont été corrigées dans Asterisk. Elles permettent à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk Open Source antérieures à 11.23.1 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 13.8 antérieures à 13.8-cert3 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions antérieures à 11.6-cert15 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 13.X antérieures à 13.11.1 |
References
| Title | Publication Time | Tags | |
|---|---|---|---|
|
|
|||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source ant\u00e9rieures \u00e0 11.23.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 13.8 ant\u00e9rieures \u00e0 13.8-cert3",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions ant\u00e9rieures \u00e0 11.6-cert15",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 13.X ant\u00e9rieures \u00e0 13.11.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [],
"initial_release_date": "2016-09-09T00:00:00",
"last_revision_date": "2016-09-09T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-007 du 08 septembre 2016",
"url": "http://downloads.asterisk.org/pub/security/AST-2016-007.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-006 du 08 septembre 2016",
"url": "http://downloads.asterisk.org/pub/security/AST-2016-006.html"
}
],
"reference": "CERTFR-2016-AVI-302",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2016-09-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eAsterisk\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-007 du 08 septembre 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-006 du 08 septembre 2016",
"url": null
}
]
}
CERTFR-2016-AVI-046
Vulnerability from certfr_avis - Published: 2016-02-04 - Updated: 2016-02-04
De multiples vulnérabilités ont été corrigées dans Asterisk. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Asterisk | Asterisk | Asterisk Open Source versions 1.8.x | ||
| Asterisk | Asterisk | Asterisk Open Source versions 13.x antérieures à 13.7.1 | ||
| Asterisk | Certified Asterisk | Certified Asterisk version 1.8.28 | ||
| Asterisk | Asterisk | Asterisk Open Source versions 12.x | ||
| Asterisk | Asterisk | Asterisk Open Source versions 11.x antérieures à 11.21.1 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 13.1 antérieures à 13.1-cert3 | ||
| Asterisk | Certified Asterisk | Certified Asterisk versions 11.6 antérieures à 11.6-cert12 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Asterisk Open Source versions 1.8.x",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 13.x ant\u00e9rieures \u00e0 13.7.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk version 1.8.28",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 12.x",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Asterisk Open Source versions 11.x ant\u00e9rieures \u00e0 11.21.1",
"product": {
"name": "Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 13.1 ant\u00e9rieures \u00e0 13.1-cert3",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
},
{
"description": "Certified Asterisk versions 11.6 ant\u00e9rieures \u00e0 11.6-cert12",
"product": {
"name": "Certified Asterisk",
"vendor": {
"name": "Asterisk",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [],
"initial_release_date": "2016-02-04T00:00:00",
"last_revision_date": "2016-02-04T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-002 du 03 f\u00e9vrier 2016",
"url": "http://downloads.asterisk.org/pub/security/AST-2016-002.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-003 du 03 f\u00e9vrier 2016",
"url": "http://downloads.asterisk.org/pub/security/AST-2016-003.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-001 du 03 f\u00e9vrier 2016",
"url": "http://downloads.asterisk.org/pub/security/AST-2016-001.html"
}
],
"reference": "CERTFR-2016-AVI-046",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2016-02-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eAsterisk\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance, un contournement\nde la politique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-003 du 03 f\u00e9vrier 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-002 du 03 f\u00e9vrier 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Asterisk AST-2016-001 du 03 f\u00e9vrier 2016",
"url": null
}
]
}