CVE-2022-26651

Опубликовано: 15 апр. 2022

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.

Ссылки

http://packetstormsecurity.com/files/166746/Asterisk-Project-Security-Advisory-AST-2022-003.html
Third Party Advisory
VDB Entry
https://downloads.asterisk.org/pub/security/
Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2022-003.html
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2022/dsa-5285
Third Party Advisory
http://packetstormsecurity.com/files/166746/Asterisk-Project-Security-Advisory-AST-2022-003.html
Third Party Advisory
VDB Entry
https://downloads.asterisk.org/pub/security/
Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2022-003.html
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2022/dsa-5285
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*

Версия от 16.0.0 (включая) до 16.25.2 (исключая)

cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*

Версия от 18.0 (включая) до 18.11.2 (исключая)

cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*

Версия от 19.0.0 (включая) до 19.3.2 (исключая)

cpe:2.3:a:digium:certified_asterisk:16.8:-:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert10:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert11:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert12:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert13:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert2:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert3:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert4:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert5:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert6:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert7:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert8:*:*:*:*:*:*

cpe:2.3:a:digium:certified_asterisk:16.8:cert9:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

EPSS

Процентиль: 55%

0.00321

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

CVE-2022-26651

CVSS3: 9.8

ubuntu

почти 4 года назад

CVE-2022-26651

CVSS3: 9.8

debian

почти 4 года назад

An issue was discovered in Asterisk through 19.x and Certified Asteris ...

GHSA-6pcv-f66p-pqqj

CVSS3: 9.8

github

почти 4 года назад

EPSS

Процентиль: 55%

0.00321

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89