| Package | Affected versions | Patched versions |
|---|---|---|
| asterisk | ≥ 20.0.0, < 20.14.1≥ 21.0.0, < 21.9.1≥ 22.0.0, < 22.4.1< 18.26.2 | 20.14.121.9.122.4.118.26.2 |
| certified asterisk | = 18.9= 20.7< 18.9 | 18.9 |
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring `cli_permissions.conf` (e.g. with the config line `deny=!*`) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free