Lucene search

Alpine Linux Development TeamALPINE:CVE-2024-35190

HistoryMay 17, 2024 - 5:15 p.m.

CVE-2024-35190

2024-05-1717:15:07

Alpine Linux Development Team

security.alpinelinux.org

asterisk

sip

vulnerability

fix

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.

OSVersionArchitecturePackageVersionFilename
Alpineedge-mainnoarchasterisk< 20.8.1-r0UNKNOWN
Alpine3.20-mainnoarchasterisk< 20.8.1-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-main	noarch	asterisk	< 20.8.1-r0	UNKNOWN
Alpine	3.20-main	noarch	asterisk	< 20.8.1-r0	UNKNOWN

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

Related for ALPINE:CVE-2024-35190