جزئیات آسیب‌پذیری
CVE-2026-57188
asterisk asteriskasterisk certified-asterisk
Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVSS 4.0
7.1بالا
شرح رسمی (انگلیسی)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP namespace prefix` handling using carefully crafted packets. The `res_xmpp` module must be loaded, an XMPP connection must be configured in `xmpp.conf`, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.1بالا | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| asterisk | asterisk | < 20.20.1 | CVEProject cvelistV5 (CNA) |
| asterisk | asterisk | >= 21.0.0-pre1, < 21.12.3 | CVEProject cvelistV5 (CNA) |
| asterisk | asterisk | >= 22.0.0-pre1, < 22.10.1 | CVEProject cvelistV5 (CNA) |
| asterisk | asterisk | >= 23.0.0-pre1, < 23.4.1 | CVEProject cvelistV5 (CNA) |
| asterisk | certified-asterisk | < 20.7-cert11 | CVEProject cvelistV5 (CNA) |
| asterisk | certified-asterisk | >= 22.8-cert1-pre1, < 22.8-cert3 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱۵- https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f x_refsource_CONFIRM
- https://github.com/asterisk/asterisk/commit/12072a559f592736a44dd9fbe1594e84714edfb4 x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/1328dbb503da4aa11a480a9c28e170f17e5f4e84 x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/3c4b08cf94eeaa3faefb3ae6c2d6ce1bd9747a13 x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/433102c16b8edfc31d28c96166fef03fe72fb923 x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/5e626250628b2579530f3f17e7b0aa37d082873b x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/d570a85e45153a36919ace5d0ab06a195b30f9d1 x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/e329a6803ac5214028f98cc5f0b7167d66e32c08 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/20.20.1 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/21.12.3 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/22.10.1 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/23.4.1 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 x_refsource_MISC
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1 x_refsource_MISC
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۰۵
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۰۸
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
۰٫۵۲٪
احتمال بهره‌برداری در ۳۰ روز
۴۴٫۳٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-787Out-of-bounds Write