FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Asterisk -- multiple vulnerabilities

Affected packages
16.15.0 < asterisk16 < 16.25.2
asterisk18 < 18.11.2


VuXML ID 8838abf0-bc47-11ec-b516-0897988a1c07
Discovery 2022-04-14
Entry 2022-04-14

The Asterisk project reports:

AST-2022-001 - When using STIR/SHAKEN, its possible to download files that are not certificates. These files could be much larger than what you would expect to download.

AST-2022-002 - When using STIR/SHAKEN, its possible to send arbitrary requests like GET to interfaces such as localhost using the Identity header.


CVE Name CVE-2022-26498
CVE Name CVE-2022-26499