CVE-2022-26498

NameCVE-2022-26498
DescriptionAn issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3194-1, DSA-5285-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
asterisk (PTS)jessie, jessie (lts)1:11.13.1~dfsg-2+deb8u8vulnerable
stretch (security)1:13.14.1~dfsg-2+deb9u6fixed
stretch (lts), stretch1:13.14.1~dfsg-2+deb9u10fixed
buster, buster (lts)1:16.28.0~dfsg-0+deb10u5fixed
buster (security)1:16.28.0~dfsg-0+deb10u4fixed
bullseye1:16.28.0~dfsg-0+deb11u4fixed
bullseye (security)1:16.28.0~dfsg-0+deb11u5fixed
sid1:22.1.0~dfsg+~cs6.14.60671435-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
asterisksourcejessie(unfixed)end-of-life
asterisksourcestretch(not affected)
asterisksourcebuster1:16.28.0~dfsg-0+deb10u1DLA-3194-1
asterisksourcebullseye1:16.28.0~dfsg-0+deb11u1DSA-5285-1
asterisksource(unstable)1:18.11.2~dfsg+~cs6.10.40431413-1

Notes

[stretch] - asterisk <not-affected> (Vulnerable code not present)
https://issues.asterisk.org/jira/browse/ASTERISK-29872
https://downloads.asterisk.org/pub/security/AST-2022-001.html

Search for package or bug name: Reporting problems