CVE-2022-26499

EUVD-2022-31057
An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
Affected Products (NVD)
VendorProductVersion
digiumasterisk
16.15.0 ≤
𝑥
≤ 16.25.1
digiumasterisk
18.0 ≤
𝑥
< 18.11.2
digiumasterisk
19.0.0 ≤
𝑥
≤ 19.3.1
debiandebian_linux
10.0
debiandebian_linux
11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
asterisk
bullseye
1:16.28.0~dfsg-0+deb11u4
fixed
bullseye (security)
1:16.28.0~dfsg-0+deb11u5
fixed
sid
1:22.0.0~dfsg+~cs6.14.60671435-1
fixed
stretch
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
asterisk
bionic
needs-triage
focal
needs-triage
impish
ignored
jammy
needs-triage
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
trusty
ignored
xenial
needs-triage
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/166745/Asterisk-Project-Security-Advisory-AST-2022-002.html
https://downloads.asterisk.org/pub/security/
https://downloads.asterisk.org/pub/security/AST-2022-002.html
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
https://www.debian.org/security/2022/dsa-5285
http://packetstormsecurity.com/files/166745/Asterisk-Project-Security-Advisory-AST-2022-002.html
https://downloads.asterisk.org/pub/security/
https://downloads.asterisk.org/pub/security/AST-2022-002.html
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
https://www.debian.org/security/2022/dsa-5285