CVE-2018-12227

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-12227
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12227.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-12227
Downstream
Published
2018-06-12T04:29:00.220Z
Modified
2026-03-14T09:26:19.835041Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.

References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type
GIT
Repo
https://github.com/asterisk/asterisk
Events
Introduced
85335355efb2d7914a1fe20ed31afcef15fd210c
Fixed
d661052e6d2eddae58bec5a04229c105d11e18f4
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fdaecead781e4216a68c672ad0864ca895a47141
Introduced
d4cc63728def7ca06ad3f70547de87bc5c9ef7c0
Fixed
97b17a97812a5b3f30dba94cc7b3b3a2e81473e5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b7607c41e4825490ffea9d09c0b3b8f9d65f87c0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9f9c03d928110b9636506f6bc7a8f88c5c315a71
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
eff7fd8517df53cc2e5b01f0c7beb1c721a8796b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d661052e6d2eddae58bec5a04229c105d11e18f4
Database specific 
{
    "versions": [
        {
            "introduced": "13.0.0"
        },
        {
            "fixed": "13.21.1"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "14.7.7"
        },
        {
            "introduced": "15.0.0"
        },
        {
            "fixed": "15.4.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "13.18-cert1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "13.18-cert2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "13.18-cert3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "13.21-cert1"
        }
    ]
}

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12227.json"