Resource exhaustion in Digium Asterisk
CVE-2022-26498
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.167 (96.9th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.164 · newest: 0.167 · change: +0.002
Affected products
- Digium Asterisk
- Debian Linux — versions 10.0, 11.0
Weakness classification (CWE)
References
- downloads.asterisk.org/pub/security/ (Vendor Advisory)
- downloads.asterisk.org/pub/security/AST-2022-001.html (Patch, Vendor Advisory)
- packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-202… (Patch, VDB Entry, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2022/11/msg00021.html (mailing-list, Mailing List, Third Party Advisory)
- www.debian.org/security/2022/dsa-5285 (vendor-advisory, Third Party Advisory)
- packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Me…
Frequently asked questions
- What is CVE-2022-26498?
- CVE-2022-26498 is a high-severity vulnerability in Digium Asterisk, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2022-04-15.
- How severe is CVE-2022-26498?
- High severity. CVSS v3 base score is 7.5 out of 10.