CVEvulnerability

CVE-2022-26498

7.5 HIGH Published 2022-04-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-04-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-400

Description

An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

Affected configurations

• digium asterisk (>= 16.15.0 <= 16.25.1) • digium asterisk (>= 18.0 < 18.11.2) • digium asterisk (>= 19.0.0 <= 19.3.1) • debian debian linux 10.0 • debian debian linux 11.0

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References