CVE-2022-26499 - An SSRF issue was discovered in Asterisk through 19.x

Back Back to CVE browser

CRITICAL

An SSRF issue was discovered in Asterisk through 19.x

Published Apr 15, 2022

9.1

CRITICAL

CVSS 3.1

EPSS 7.74%

Description

An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (6)

http://packetstormsecurity.com/files/166745/Asterisk-Project-Security-Advisory-AST-2022-002.html
PatchThird Party AdvisoryVDB Entry
https://downloads.asterisk.org/pub/security/
Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2022-002.html
PatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-31057
Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
mailing-listIssue TrackingThird Party Advisory
https://www.debian.org/security/2022/dsa-5285
vendor-advisoryThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/166745/Asterisk-Project-Security-Advisory-AST-2022-002.html		PatchThird Party AdvisoryVDB Entry
https://downloads.asterisk.org/pub/security/		Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2022-002.html		PatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-31057		Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html		mailing-listIssue TrackingThird Party Advisory
https://www.debian.org/security/2022/dsa-5285		vendor-advisoryThird Party Advisory