CVE-2014-2286
high · 7.5main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.
7.5
CVSS
16.4%
EPSS (exploit prob.)
97th
EPSS percentile
2014-04-18
Published
AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| digium | asterisk | 1.8.0 |
| digium | asterisk | 1.8.0 |
| digium | asterisk | 1.8.0 |
| digium | asterisk | 1.8.0 |
| digium | asterisk | 1.8.0 |
| digium | asterisk | 1.8.0 |
| digium | asterisk | 1.8.0 |
| digium | asterisk | 1.8.0 |
| digium | asterisk | 1.8.0 |
| digium | asterisk | 1.8.0 |
| digium | asterisk | 1.8.1 |
| digium | asterisk | 1.8.1 |
| digium | asterisk | 1.8.1.1 |
| digium | asterisk | 1.8.1.2 |
| digium | asterisk | 1.8.2 |
| digium | asterisk | 1.8.2.1 |
| digium | asterisk | 1.8.2.2 |
| digium | asterisk | 1.8.2.3 |
| digium | asterisk | 1.8.2.4 |
| digium | asterisk | 1.8.3 |
| digium | asterisk | 1.8.3 |
| digium | asterisk | 1.8.3 |
| digium | asterisk | 1.8.3 |
| digium | asterisk | 1.8.3.1 |
| digium | asterisk | 1.8.3.2 |
| digium | asterisk | 1.8.3.3 |
| digium | asterisk | 1.8.4 |
| digium | asterisk | 1.8.4 |
| digium | asterisk | 1.8.4 |
| digium | asterisk | 1.8.4 |
| digium | asterisk | 1.8.4.1 |
| digium | asterisk | 1.8.4.2 |
| digium | asterisk | 1.8.4.3 |
| digium | asterisk | 1.8.4.4 |
| digium | asterisk | 1.8.5 |
| digium | asterisk | 1.8.5 |
| digium | asterisk | 1.8.5.0 |
| digium | asterisk | 1.8.6.0 |
| digium | asterisk | 1.8.6.0 |
| digium | asterisk | 1.8.6.0 |
Check a specific version with /api/v1/cve/match.
References
- http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff
- http://downloads.asterisk.org/pub/security/AST-2014-001.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:078
- http://www.securityfocus.com/bid/66093
- https://issues.asterisk.org/jira/browse/ASTERISK-23340
- http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff
- http://downloads.asterisk.org/pub/security/AST-2014-001.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:078
- http://www.securityfocus.com/bid/66093
- https://issues.asterisk.org/jira/browse/ASTERISK-23340
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2014-2286