The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9,     20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using     libxml with unsafe parsing options that enable entity expansion and XInclude processing. Specifically, it     invokes xmlReadFile() with the XML_PARSE_NOENT flag and later processes XIncludes via     xmlXIncludeProcess().If any untrusted or user-supplied XML file is passed to this function, it can allow     an attacker to trigger XML External Entity (XXE) or XInclude-based local file disclosure, potentially     exposing sensitive files from the host system. This can also be triggered in other cases in which the user     is able to supply input in xml format that triggers the asterisk process to parse it. This issue has been     patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2. (CVE-2026-23739)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-23739

medium Nessus Plugin ID 298277

Version 1.2