CVE-2018-12227: Infoleak
An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12227?
The severity of CVE-2018-12227 is medium with a severity value of 5.3.
What is the affected software for CVE-2018-12227?
The affected software for CVE-2018-12227 includes Asterisk Open Source versions 13.x, 14.x, and 15.x, as well as Certified Asterisk versions 13.18-cert and 13.21-cert.
How does CVE-2018-12227 impact Asterisk Open Source?
CVE-2018-12227 in Asterisk Open Source allows endpoint specific ACL rules to respond with a 403 forbidden error when blocking a SIP request.
How can I fix CVE-2018-12227 vulnerability?
To fix CVE-2018-12227 vulnerability, it is recommended to upgrade to the patched versions of Asterisk Open Source and Certified Asterisk.
Where can I find more information about CVE-2018-12227?
You can find more information about CVE-2018-12227 on the Asterisk security advisory page and Debian security tracker.