Date: Sun, 12 Jan 2025 19:05:12 GMT
From: Fernando =?utf-8?Q?Apestegu=C3=ADa?= <fernape@FreeBSD.org>
To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org
Subject: git: a237308ba756 - main - security/vuxml: add asterisk{18,20} vulns
Message-ID: <202501121905.50CJ5COu094639@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by fernape: URL: https://cgit.FreeBSD.org/ports/commit/?id=a237308ba756671d748f5ffe6dbdb632b12e2c53 commit a237308ba756671d748f5ffe6dbdb632b12e2c53 Author: Fernando Apesteguía <fernape@FreeBSD.org> AuthorDate: 2025-01-12 19:02:58 +0000 Commit: Fernando Apesteguía <fernape@FreeBSD.org> CommitDate: 2025-01-12 19:04:57 +0000 security/vuxml: add asterisk{18,20} vulns CVE-2024-53566: Path traversal * Base Score: 5.5 MEDIUM * Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N --- security/vuxml/vuln/2025.xml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index f4e44f9d9f30..e2bd8727d1c4 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,35 @@ + <vuln vid="7624c151-d116-11ef-b232-b42e991fc52e"> + <topic>asterisk - path traversal</topic> + <affects> + <package> + <name>asterisk18</name> + <range><lt>18.26.20</lt></range> + </package> + <package> + <name>asterisk20</name> + <range><lt>20.11.0</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>cve@mitre.org reports:</p> + <blockquote cite="https://gist.github.com/hyp164D1/e7c0f44ffb38c00320aa1a6d98bee616">; + <p>An issue in the action_listcategories() function of Sangoma Asterisk + v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to + execute a path traversal.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2024-53566</cvename> + <url>https://nvd.nist.gov/vuln/detail/CVE-2024-53566</url>; + </references> + <dates> + <discovery>2024-12-02</discovery> + <entry>2025-01-12</entry> + </dates> + </vuln> + <vuln vid="4d79fd1a-cc93-11ef-abed-08002784c58d"> <topic>redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202501121905.50CJ5COu094639>