| Package | Affected versions | Patched versions |
|---|---|---|
| asterisk | = 21.0.0≥ 19.0.0, < 20.5.1< 18.20.1 | 20.5.118.20.1 |
| certified asterisk | = 13.13.0= 16.8.0= 18.9 |
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free