CVE Vulnerability

CVE-2022-42705

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscription via a reliable transport at the same time that Asterisk is also performing activity on that subscription.

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://downloads.asterisk.org/pub/security/AST-2022-008.html Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
https://www.debian.org/security/2023/dsa-5358
Configurations

Configuration 1

cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*
cpe:2.3:a:sangoma:asterisk:20.0.0:*:*:*:*:*:*:*
Information

Published : 2022-12-05 09:15

Updated : 2023-02-24 12:15

NVD link : CVE-2022-42705

Mitre link : CVE-2022-42705

Products Affected
No products.
CWE
CWE-416