QwikSec

Security Database

CVE

CWE

Training

CVE-2022-26498

Published: Apr 15, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://downloads.asterisk.org/pub/security/

https://downloads.asterisk.org/pub/security/AST-2022-001.html

http://packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-2022-001.html

[debian-lts-announce] 20221117 [SECURITY] [DLA 3194-1] asterisk security update

mailing-list

vendor-advisory

http://packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Memory-Corruption.html

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.