Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-26498

An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

Published

2022-04-15T05:15:06.597

Last Modified

2024-11-21T06:54:03.827

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-400
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application digium asterisk ≤ 16.25.1 Yes
Application digium asterisk < 18.11.2 Yes
Application digium asterisk ≤ 19.3.1 Yes
Operating System debian debian_linux 10.0 Yes
Operating System debian debian_linux 11.0 Yes
References