CVE-2022-26498: digium asterisk +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-26498

CVSS 7.5 · High EPSS 16,5%

Kerentanan Uncontrolled Resource Consumption pada digium asterisk, debian linux. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

Rincian

Terbit di NVD: 15 April 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari): 16,5% peluang dieksploitasi; lebih tinggi dari 96,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
digium	asterisk	Versi 16.15.0 hingga 16.25.1
digium	asterisk	Versi 18.0 hingga sebelum 18.11.2
digium	asterisk	Versi 19.0.0 hingga 19.3.1
debian	debian linux	Versi 10.0
debian	debian linux	Versi 11.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://downloads.asterisk.org/pub/security/ advisory vendor
https://downloads.asterisk.org/pub/security/AST-2022-001.html patch · advisory vendor
http://packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-2022-001.html patch · advisory pihak ketiga · vdb entry
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html mailing list · advisory pihak ketiga
https://www.debian.org/security/2022/dsa-5285 advisory pihak ketiga
http://packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Memory-Corruption.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.