CVE-2022-26651
An issue was discovered in Asterisk through 19.x and Certified Asteris ...
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD.
Beschreibung
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.15 | asterisk | 18.2.2-r6 |
| alpine 3.16 | asterisk | 18.11.2-r0 |
| alpine 3.17 | asterisk | 18.11.2-r0 |
| alpine 3.18 | asterisk | 18.11.2-r0 |
| alpine 3.19 | asterisk | 18.11.2-r0 |
| alpine 3.20 | asterisk | 18.11.2-r0 |
| alpine 3.21 | asterisk | 18.11.2-r0 |
| alpine 3.22 | asterisk | 18.11.2-r0 |
| alpine 3.23 | asterisk | 18.11.2-r0 |
| alpine 3.24 | asterisk | 18.11.2-r0 |
| alpine edge | asterisk | 18.11.2-r0 |
| debian 10 | asterisk | 1:16.28.0~dfsg-0+deb10u1 |
Alle 50 Einträge aus 16 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.15 | asterisk | 18.2.2-r6 |
| alpine 3.16 | asterisk | 18.11.2-r0 |
| alpine 3.17 | asterisk | 18.11.2-r0 |
| alpine 3.18 | asterisk | 18.11.2-r0 |
| alpine 3.19 | asterisk | 18.11.2-r0 |
| alpine 3.20 | asterisk | 18.11.2-r0 |
| alpine 3.21 | asterisk | 18.11.2-r0 |
| alpine 3.22 | asterisk | 18.11.2-r0 |
| alpine 3.23 | asterisk | 18.11.2-r0 |
| alpine 3.24 | asterisk | 18.11.2-r0 |
| alpine edge | asterisk | 18.11.2-r0 |
| debian 10 | asterisk | 1:16.28.0~dfsg-0+deb10u1 |
| debian 11 | asterisk | 1:16.28.0~dfsg-0+deb11u1 |
| debian 14 | asterisk | 1:18.11.2~dfsg+~cs6.10.40431413-1 |
| debian 9 | asterisk | kein Fix angegeben |
| rapidfort fedora 43 | asterisk | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-ael | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-alembic | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-alsa | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-calendar | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-corosync | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-curl | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-dahdi | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-devel | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-fax | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-festival | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-hep | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-iax2 | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-ldap | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-lua | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-mgcp | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-minivm | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-mobile | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-mwi-external | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-mysql | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-odbc | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-oss | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-pjsip | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-portaudio | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-postgresql | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-radius | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-sip | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-skinny | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-snmp | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-sqlite | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-tds | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-unistim | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-voicemail | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-voicemail-odbc | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-voicemail-plain | 18.26.4-1.fc43 |
Referenzen
- http://packetstormsecurity.com/files/166746/Asterisk-Project-Security-Advisory-AST-2022-003.html
- https://downloads.asterisk.org/pub/security/
- https://downloads.asterisk.org/pub/security/AST-2022-003.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://www.debian.org/security/2022/dsa-5285