CVE-2022-26651
An issue was discovered in Asterisk through 19.x and Certified Asteris ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD.
Descripción
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.15 | asterisk | 18.2.2-r6 |
| alpine 3.16 | asterisk | 18.11.2-r0 |
| alpine 3.17 | asterisk | 18.11.2-r0 |
| alpine 3.18 | asterisk | 18.11.2-r0 |
| alpine 3.19 | asterisk | 18.11.2-r0 |
| alpine 3.20 | asterisk | 18.11.2-r0 |
| alpine 3.21 | asterisk | 18.11.2-r0 |
| alpine 3.22 | asterisk | 18.11.2-r0 |
| alpine 3.23 | asterisk | 18.11.2-r0 |
| alpine 3.24 | asterisk | 18.11.2-r0 |
| alpine edge | asterisk | 18.11.2-r0 |
| debian 10 | asterisk | 1:16.28.0~dfsg-0+deb10u1 |
Mostrar las 50 entradas de 16 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.15 | asterisk | 18.2.2-r6 |
| alpine 3.16 | asterisk | 18.11.2-r0 |
| alpine 3.17 | asterisk | 18.11.2-r0 |
| alpine 3.18 | asterisk | 18.11.2-r0 |
| alpine 3.19 | asterisk | 18.11.2-r0 |
| alpine 3.20 | asterisk | 18.11.2-r0 |
| alpine 3.21 | asterisk | 18.11.2-r0 |
| alpine 3.22 | asterisk | 18.11.2-r0 |
| alpine 3.23 | asterisk | 18.11.2-r0 |
| alpine 3.24 | asterisk | 18.11.2-r0 |
| alpine edge | asterisk | 18.11.2-r0 |
| debian 10 | asterisk | 1:16.28.0~dfsg-0+deb10u1 |
| debian 11 | asterisk | 1:16.28.0~dfsg-0+deb11u1 |
| debian 14 | asterisk | 1:18.11.2~dfsg+~cs6.10.40431413-1 |
| debian 9 | asterisk | sin corrección indicada |
| rapidfort fedora 43 | asterisk | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-ael | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-alembic | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-alsa | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-calendar | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-corosync | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-curl | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-dahdi | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-devel | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-fax | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-festival | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-hep | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-iax2 | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-ldap | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-lua | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-mgcp | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-minivm | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-mobile | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-mwi-external | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-mysql | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-odbc | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-oss | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-pjsip | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-portaudio | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-postgresql | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-radius | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-sip | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-skinny | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-snmp | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-sqlite | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-tds | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-unistim | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-voicemail | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-voicemail-odbc | 18.26.4-1.fc43 |
| rapidfort fedora 43 | asterisk-voicemail-plain | 18.26.4-1.fc43 |
Referencias
- http://packetstormsecurity.com/files/166746/Asterisk-Project-Security-Advisory-AST-2022-003.html
- https://downloads.asterisk.org/pub/security/
- https://downloads.asterisk.org/pub/security/AST-2022-003.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://www.debian.org/security/2022/dsa-5285