← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to active/CVE-2018-12227

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
active/CVE-2018-12227
1
 
Candidate: CVE-2018-12227
2
 
PublicDate: 2018-06-12
3
 
References:
4
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12227
5
 
 http://downloads.asterisk.org/pub/security/AST-2018-008.html
6
 
 https://issues.asterisk.org/jira/browse/ASTERISK-27818
7
 
Description:
8
 
 An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x
9
 
 before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert
10
 
 before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint
11
 
 specific ACL rules block a SIP request, they respond with a 403 forbidden.
12
 
 However, if an endpoint is not identified, then a 401 unauthorized response
13
 
 is sent. This vulnerability just discloses which requests hit a defined
14
 
 endpoint. The ACL rules cannot be bypassed to gain access to the disclosed
15
 
 endpoints.
16
 
Ubuntu-Description:
17
 
Notes:
18
 
Bugs:
19
 
Priority: low
20
 
Discovered-by:
21
 
Assigned-to:
22
 
 
23
 
 
24
 
Patches_asterisk:
25
 
upstream_asterisk: needs-triage
26
 
precise/esm_asterisk: DNE
27
 
trusty_asterisk: needs-triage
28
 
xenial_asterisk: needs-triage
29
 
artful_asterisk: needs-triage
30
 
bionic_asterisk: needs-triage
31
 
devel_asterisk: needs-triage