PT-2022-17984 · Sangoma+1 · Asterisk+1

Leandro Dardini · Published 2020-07-06 · Updated 2023-02-02 · CVE-2022-26651

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 16.25.2 Asterisk versions prior to 18.11.2 Asterisk versions prior to 19.3.2 Certified Asterisk versions prior to 16.8-cert14

Description An issue was discovered in the func odbc module, which provides possibly inadequate escaping functionality for backslash characters in SQL queries. This could result in user-provided data creating a broken SQL query or possibly a SQL injection.

Recommendations For Asterisk versions prior to 16.25.2, update to version 16.25.2 or later. For Asterisk versions prior to 18.11.2, update to version 18.11.2 or later. For Asterisk versions prior to 19.3.2, update to version 19.3.2 or later. For Certified Asterisk versions prior to 16.8-cert14, update to version 16.8-cert14 or later. As a temporary workaround, consider disabling the func odbc module until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2020-2313

CVE-2022-26651

DLA-3194-1

DSA-5285-1

Affected Products

Alt Linux

Asterisk

References · 22

• https://cve.org/CVERecord?id=CVE-2022-26651 · Security Note
• https://downloads.asterisk.org/pub/security · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-26651 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5285-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-26651 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3194-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-26651 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26651 · Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2022-003.html · Vendor Advisory
• https://debian.org/security/2022/dsa-5285 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-26651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26651 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-26651 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html · Note
• http://packetstormsecurity.com/files/166746/Asterisk-Project-Security-Advisory-AST-2022-003.html · Note