CVE-2018-7284

描述

A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.

如何修補 CVE-2018-7284

要修補 CVE-2018-7284,請將受影響套件升級到下列已修補版本。

• —升級至 1:13.20.0~dfsg-1 或更新版本

CVE-2018-7284 正在被利用嗎?

可能 — EPSS 為 58.3%,屬於高被利用機率區間,建議優先修補。

受影響套件(1)

• from 0, < 1:13.20.0~dfsg-1

CVSS 分數

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2018-7284