CVE-2023-49294

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the live_dangerously is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49294.json"
}

References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type

GIT

Repo

https://github.com/asterisk/asterisk

Events

Introduced

Fixed

14d0e59f3d8f7521621561168ef4a297702d978f

Last affected

12da95e53ff42287ad69d6d5922e06c3d62010ac

Fixed

35e0c6c0f4ec35493e9a4bb938226722ded35c61

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "18.20.1"
        },
        {
            "last_affected": "= 21.0.0"
        },
        {
            "fixed": "18.9-cert6"
        }
    ]
}

Type

GIT

Repo

https://github.com/asterisk/asterisk

Events

Introduced

de4f63b4824c91a0cd9f3d95f3b7923bec71960c

Fixed

f7a8ac086de697db30e376d589a6f4e17cfabef5

Database specific

{
    "versions": [
        {
            "introduced": "19.0.0"
        },
        {
            "fixed": "20.5.1"
        }
    ]
}

Affected versions

21.*

21.0.0

21.0.0-pre1

21.0.0-rc1