what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Clint Ruoho

Asterisk Project Security Advisory - AST-2022-002

Posted Apr 15, 2022

Authored by Ben Ford, Clint Ruoho | Site asterisk.org

Asterisk suffers from a server-side request forgery vulnerability. When using STIR/SHAKEN, it is possible to send arbitrary requests like GET to interfaces such as localhost using the Identity header. Asterisk Open Source versions 16.15.0 up to but not including 16.25.2, 18.x up to but not including 18.11.2, and 19.x up to but not including 19.3.2 are affected.

tags | advisory, arbitrary

advisories | CVE-2022-26499

SHA-256 | 7727f89aa5888d067b6bf9ed78cdb7e6304adf0a733433e0687a3678d88eb17b

Download | Favorite | View