UBUNTU-CVE-2022-26651

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2022-26651
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-26651.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-26651
Related
Published
2022-04-15T05:15:00Z
Modified
2024-10-15T14:09:51Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.

References

Affected packages

Ubuntu:Pro:16.04:LTS / asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:13.*

1:13.1.0~dfsg-1.1ubuntu3
1:13.1.0~dfsg-1.1ubuntu4
1:13.1.0~dfsg-1.1ubuntu4.1
1:13.1.0~dfsg-1.1ubuntu4.1+esm1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=src?distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:13.*

1:13.17.2~dfsg-1ubuntu1
1:13.17.2~dfsg-2ubuntu1
1:13.18.1~dfsg-1ubuntu1
1:13.18.3~dfsg-1ubuntu1
1:13.18.3~dfsg-1ubuntu2
1:13.18.3~dfsg-1ubuntu3
1:13.18.3~dfsg-1ubuntu4

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:16.*

1:16.2.1~dfsg-2build2
1:16.2.1~dfsg-2build3
1:16.2.1~dfsg-2ubuntu1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:16.*

1:16.16.1~dfsg-2
1:16.16.1~dfsg-4
1:16.16.1~dfsg-4build1
1:16.16.1~dfsg+~2.10-1

1:18.*

1:18.10.0~dfsg+~cs6.10.40431411-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=src?distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:20.*

1:20.6.0~dfsg+~cs6.13.40431414-2build5
1:20.8.1~dfsg+~cs6.14.40431414-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:20.*

1:20.4.0~dfsg+~cs6.13.40431414-2
1:20.5.0~dfsg+~cs6.13.40431414-1
1:20.5.1~dfsg+~cs6.13.40431414-1
1:20.5.2~dfsg+~cs6.13.40431414-1
1:20.6.0~dfsg+~cs6.13.40431414-1
1:20.6.0~dfsg+~cs6.13.40431414-2
1:20.6.0~dfsg+~cs6.13.40431414-2build3
1:20.6.0~dfsg+~cs6.13.40431414-2build4
1:20.6.0~dfsg+~cs6.13.40431414-2build5

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}