An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
{
"versions": [
{
"introduced": "16.15.0"
},
{
"last_affected": "16.25.1"
},
{
"introduced": "18.0"
},
{
"fixed": "18.11.2"
},
{
"introduced": "19.0.0"
},
{
"last_affected": "19.3.1"
},
{
"introduced": "0"
},
{
"last_affected": "10.0"
},
{
"introduced": "0"
},
{
"last_affected": "11.0"
}
]
}