CVSS 6.5 · Medium EPSS 0,45%
Kerentanan NULL Pointer Dereference pada sangoma asterisk, sangoma certified asterisk. Skor CVSS 3.1 6.5 (Medium) menurut NVD.
Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, between 20.00.0 and 20.15.0, 20.7-cert6, 21.00.0, 22.00.0 through 22.5.0, there is a remote DoS and possible RCE condition in `asterisk/res/res_stir_shaken /verification.c` that can be exploited when an attacker can set an arbitrary Identity header, or STIR/SHAKEN is enabled, with verification set in the SIP profile associated with the endpoint to be attacked. This is fixed in versions 18.26.3, 20.7-cert6, 20.15.1, 21.10.1 and 22.5.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| sangoma | asterisk | Semua versi sebelum 18.26.3 |
| sangoma | asterisk | Versi 20.0.0 hingga sebelum 20.15.1 |
| sangoma | asterisk | Versi 21.0.0 hingga sebelum 21.10.1 |
| sangoma | asterisk | Versi 22.0.0 hingga sebelum 22.5.1 |
| sangoma | certified asterisk | Semua versi hingga 18.9 |
| sangoma | certified asterisk | Versi 20.7 cert1 |
| sangoma | certified asterisk | Versi 20.7 cert1-rc1 |
| sangoma | certified asterisk | Versi 20.7 cert1-rc2 |
| sangoma | certified asterisk | Versi 20.7 cert2 |
| sangoma | certified asterisk | Versi 20.7 cert3 |
| sangoma | certified asterisk | Versi 20.7 cert4 |
| sangoma | certified asterisk | Versi 20.7 cert5 |
| sangoma | certified asterisk | Versi 20.7 cert6 |