CVE-2018-12227 — Sensitive Information Exposure in Asterisk

CWE-200 — Sensitive Information Exposure7 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
1.1%
top 22.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Digium AsteriskDebian AsteriskDebian Linux+1 more
Timeline
PublishedJun 12
Latest updateMay 14

Description

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to th…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶NVDdigium/certified_asterisk13.18, 13.21+1
▶NVDdigium/asterisk13.0.0 — 13.21.1+2
▶debiandebian/asterisk< asterisk 1:13.22.0~dfsg-1 (bullseye)
▶Debiandigium/asterisk< 1:13.22.0~dfsg-1

Also affects: Debian Linux 9.0

Patches

Patch: issues.asterisk.org ↗Patch: issues.asterisk.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-cvxq-f65j-c34v: An issue was discovered in Asterisk Open Source 13↗2022-05-14
▶
OSV
CVE-2018-12227: An issue was discovered in Asterisk Open Source 13↗2018-06-12
▶

📋Vendor Advisories

1
Debian
CVE-2018-12227: asterisk - An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-12227 asterisk: PJSIP endpoint presence disclosure when using ACL↗2018-06-12
▶
Bugzilla
CVE-2018-12227 CVE-2018-12228 asterisk: various flaws [epel-6]↗2018-06-12
▶
Bugzilla
CVE-2018-12227 CVE-2018-12228 asterisk: various flaws [fedora-all]↗2018-06-12
▶
CVE-2018-12227 — Sensitive Information Exposure | cvebase