CVE-2022-26499: SSRF
Published Apr 15, 2022
·Updated
An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
Affected Software
6 affected componentsFixes available
debian/asterisk<=1:16.2.1~dfsg-1+deb10u2
1:16.28.0~dfsg-0+deb10u41:16.28.0~dfsg-0+deb11u31:20.5.2~dfsg+~cs6.13.40431414-1
Digium Asterisk>=16.15.0<=16.25.1
Digium Asterisk>=18.0<18.11.2
Digium Asterisk>=19.0.0<=19.3.1
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Remediation
Event History
Apr 15, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is CVE-2022-26499?
CVE-2022-26499 is an SSRF (Server-Side Request Forgery) vulnerability in Asterisk through 19.x.
2
How does CVE-2022-26499 work?
CVE-2022-26499 allows an attacker to send arbitrary requests to interfaces such as localhost by using the Identity header when using STIR/SHAKEN in Asterisk.
3
What is the severity of CVE-2022-26499?
CVE-2022-26499 has a severity rating of critical with a CVSS score of 9.1.
4
Which versions of Asterisk are affected by CVE-2022-26499?
Asterisk versions up to 16.25.1, 18.11.2, and 19.3.1 are affected by CVE-2022-26499.
5
How can I fix CVE-2022-26499?
To fix CVE-2022-26499, update Asterisk to version 16.25.2, 18.11.2, or 19.3.2.