CVE-2022-37325: High severity Sangoma Asterisk vulnerability
In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:16.28.0~dfsg-0+deb10u4Fixed in 1:16.28.0~dfsg-0+deb11u3Fixed in 1:20.5.2~dfsg+~cs6.13.40431414-1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-37325.
What is the severity of CVE-2022-37325?
The severity of CVE-2022-37325 has not been specified.
Which versions of Sangoma Asterisk are affected by CVE-2022-37325?
Sangoma Asterisk versions through 16.28.0, 17.x through 17.6.0, 18.x through 18.14.0, and 19.x through 19.6.0 are affected.
How can a crash be triggered in Sangoma Asterisk due to CVE-2022-37325?
A crash can be triggered in Sangoma Asterisk by sending an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE.
Is there a fix available for CVE-2022-37325?
Yes, the fix for CVE-2022-37325 is available in the following versions: 1:16.28.0~dfsg-0+deb10u3, 1:16.28.0~dfsg-0+deb11u2, 1:16.28.0~dfsg-0+deb11u3, 1:20.4.0~dfsg+~cs6.13.40431414-2.