Alpine: asterisk: security update to 18.20.2-r0

critical Tenable Cloud Security Plugin ID 408227

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- PJSIP is a free and open source multimedia communication library written in C language implementing
standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when
parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications
that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch
(2.13.1). (CVE-2022-23537)

- In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming
Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a
crash. (CVE-2022-37325)

- A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2
may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on
a subscription via a reliable transport at the same time that Asterisk is also performing activity on that
subscription. (CVE-2022-42705)

- An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and
certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to
access files outside of the asterisk configuration directory, aka Directory Traversal. (CVE-2022-42706)

Plugin Details

Severity: Critical

ID: 408227

Version: Revision 1.16

Type: Local

Family: Alpine Linux Local Security Checks

Published: 1/12/2024

Updated: 12/31/2025

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.49

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-23537

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 12/5/2022

Reference Information

CVE: CVE-2022-23537, CVE-2022-37325, CVE-2022-42705, CVE-2022-42706, CVE-2023-37457, CVE-2023-49294, CVE-2023-49786

Detections

Analytics