جزئیات آسیب‌پذیری
CVE-2026-57185
asterisk asteriskasterisk certified-asterisk
Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVSS 3.1
6.5متوسط
شرح رسمی (انگلیسی)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP MWI body parser` by sending a carefully crafted `SIP NOTIFY` request. The attacker must pass SIP authentication using either a username/password or `source IP address matching`. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 6.5متوسط | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| asterisk | asterisk | < 20.20.1 | CVEProject cvelistV5 (CNA) |
| asterisk | asterisk | >= 21.0.0-pre1, < 21.12.3 | CVEProject cvelistV5 (CNA) |
| asterisk | asterisk | >= 22.0.0-pre1, < 22.10.1 | CVEProject cvelistV5 (CNA) |
| asterisk | asterisk | >= 23.0.0-pre1, < 23.4.1 | CVEProject cvelistV5 (CNA) |
| asterisk | certified-asterisk | < 20.7-cert11 | CVEProject cvelistV5 (CNA) |
| asterisk | certified-asterisk | >= 22.8-cert1-pre1, < 22.8-cert3 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱۵- https://github.com/asterisk/asterisk/security/advisories/GHSA-8jw3-ccr9-xrmf x_refsource_CONFIRM
- https://github.com/asterisk/asterisk/commit/07aec894a1fdfa7fa989d3ab40fdf0dcda8005bb x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/1039bed76fa3248f58b6880e4b3f1421ef98b01f x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/1b2d99d8eb9206d37fd47115996f67fd28bd056f x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/3100a0d331affbf0995b8c57aaddb31cf3971f6e x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/57ce484a45b098de417f19265c95c64497782e36 x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/919f2ffda03329c9014bedcb3c7789d38660c9ed x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/dafff9fb60281817225f1ce6371a5aa2fbb967a4 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/20.20.1 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/21.12.3 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/22.10.1 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/23.4.1 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 x_refsource_MISC
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1 x_refsource_MISC
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۰۵
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۰۸
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
۰٫۴۷٪
احتمال بهره‌برداری در ۳۰ روز
۴۱٫۳٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-126Buffer Over-read
- CWE-170Improper Null Termination