CVE-2022-42705

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscription via a reliable transport at the same time that Asterisk is also performing activity on that subscription.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42705.json"
}

References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type

GIT

Repo

https://github.com/asterisk/asterisk

Events

Introduced

a65908f83e2f17a3aca7eb39c8e06045aca02674

Fixed

dd2ebdb336f13c93f7f46ee5f1f65544f4d8ab3b

Introduced

cdb67c6b99459c7731ba926d6eba3e24be79f905

Fixed

226868d1139af566c481265ef9657a1b33aa065e

Introduced

cd3505fa5a41c97a1e392c090a3619cd155c0c50

Fixed

4c6f3fd7847bbb6111a6e615780e62780c42f9de

Introduced

c6c7103efa6605a6db7ca28b4b17cd2d1c15a05c

Last Affected

3167634a5ba20e099a37164fd27fa9e5fa6d07d0

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "16.0.0"
                },
                {
                    "fixed": "16.29.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "18.14.0"
                },
                {
                    "fixed": "18.15.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "19.6.0"
                },
                {
                    "fixed": "19.7.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:sangoma:asterisk:20.0.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "20.0.0"
                },
                {
                    "last_affected": "20.0.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "18.9-cert2"
                },
                {
                    "last_affected": "18.9-cert2"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

18.*

18.9-cert2

20.*

20.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42705.json"