PT-2022-17903 · Asterisk · Asterisk

Clint Ruoho · Published 2022-04-15 · Updated 2023-02-02 · CVE-2022-26499

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 16.25.2 Asterisk versions prior to 18.11.2 Asterisk versions prior to 19.3.2

Description An issue was discovered in Asterisk. When using STIR/SHAKEN, it's possible to send arbitrary requests, such as GET, to interfaces like localhost by using the Identity header.

Recommendations For versions prior to 16.25.2, update to version 16.25.2 or later. For versions prior to 18.11.2, update to version 18.11.2 or later. For versions prior to 19.3.2, update to version 19.3.2 or later. As a temporary workaround, consider restricting the use of the Identity header when using STIR/SHAKEN until a patch is applied.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-26499

DLA-3194-1

DSA-5285-1

Affected Products

Asterisk

References · 21

• https://downloads.asterisk.org/pub/security · Vendor Advisory
• http://packetstormsecurity.com/files/166745/Asterisk-Project-Security-Advisory-AST-2022-002.html · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-26499 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-26499 · Security Note
• https://osv.dev/vulnerability/DSA-5285-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-26499 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26499 · Security Note
• https://osv.dev/vulnerability/DLA-3194-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-26499 · Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2022-002.html · Vendor Advisory
• https://debian.org/security/2022/dsa-5285 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26499 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-26499 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-26499 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html · Note