DEBIAN-CVE-2023-49294

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2023-49294
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-49294.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2023-49294
Upstream
Published
2023-12-14T20:15:52Z
Modified
2025-09-19T07:33:30.777788Z
Summary
[none]
Details

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the live_dangerously is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.

References

Affected packages

Debian:11 / asterisk

Package

Name
asterisk
Purl
pkg:deb/debian/asterisk?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:16.28.0~dfsg-0+deb11u4

Affected versions

1:16.*

1:16.16.1~dfsg-1
1:16.16.1~dfsg-1+deb11u1~bpo10+1
1:16.16.1~dfsg-1+deb11u1
1:16.16.1~dfsg-2
1:16.16.1~dfsg-3
1:16.16.1~dfsg-4
1:16.16.1~dfsg+~2.10-1
1:16.16.1~dfsg+~2.10-2
1:16.23.0~dfsg+~2.10-1
1:16.23.0~dfsg+~cs6.10.20220309-1
1:16.23.0~dfsg+~cs6.10.20220309-2
1:16.23.0~dfsg+~cs6.10.40431411-1
1:16.28.0~dfsg-0+deb11u1
1:16.28.0~dfsg-0+deb11u2
1:16.28.0~dfsg-0+deb11u3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}