Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-42705

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscription via a reliable transport at the same time that Asterisk is also performing activity on that subscription.

Published

2022-12-05T21:15:10.177

Last Modified

2025-04-24T15:15:50.547

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses
  • Type: Primary
    CWE-416
  • Type: Secondary
    CWE-416
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sangoma asterisk < 16.29.1 Yes
Application sangoma asterisk < 18.15.1 Yes
Application sangoma asterisk < 19.7.1 Yes
Application sangoma asterisk 20.0.0 Yes
Application sangoma certified_asterisk 18.9 Yes
References