CVE-2022-26651: SQL Injection
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The funcodbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26651?
The severity of CVE-2022-26651 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2022-26651?
Asterisk versions through 19.x and Certified Asterisk versions through 16.8-cert13 are affected by CVE-2022-26651.
What is the vulnerability description for CVE-2022-26651?
The func_odbc module in Asterisk provides inadequate escaping functionality for backslash characters in SQL queries, leading to a broken SQL query or a possible SQL injection.
How can I fix CVE-2022-26651?
Upgrade to Asterisk version 20.4.0~dfsg+~cs6.13.40431414-2 or higher, or use the Debian package version 1:16.28.0~dfsg-0+deb10u3, 1:16.28.0~dfsg-0+deb11u3, or 1:20.4.0~dfsg+~cs6.13.40431414-2.
What is the Common Weakness Enumeration (CWE) for CVE-2022-26651?
The CWE for CVE-2022-26651 is CWE-89 (SQL Injection).