CVE:CVE-2022-26651
CNNVD:CNNVD-202204-3446
Asterisk是一款PBX系统的软件，运行在Linux系统上，支持使用SIP、IAX、H323协议进行IP通话。
Asterisk 19.x 版本及之前版本和 Certified Asterisk 16.8-cert13 版本及之前版本 func_odbc 模块存在SQL注入漏洞，该漏洞源于 func_odbc 模块为 SQL 查询中的反斜杠字符提供可能不足的转义功能，从而导致用户提供的数据创建损坏的 SQL 查询或可能的 SQL 注入。
solution:Upgrade digium asterisk to a higher version than 16.25.2,18.11.2,19.3.2,and avoid the version [16.0.0,16.25.2),[18.0,18.11.2),[19.0.0,19.3.2); Upgrade digium certified_asterisk to a higher version than 16.8,16.8:cert1-rc1,16.8:cert1-rc2,16.8:cert1-rc3,16.8:cert1-rc4,16.8:cert10,16.8:cert11,16.8:cert12,16.8:cert13,16.8:cert2,16.8:cert3,16.8:cert4,16.8:cert4-rc1,16.8:cert4-rc2,16.8:cert4-rc3,16.8:cert4-rc4,16.8:cert5,16.8:cert6,16.8:cert7,16.8:cert8,16.8:cert9,and avoid the version 16.8,16.8:cert1-rc1,16.8:cert1-rc2,16.8:cert1-rc3,16.8:cert1-rc4,16.8:cert10,16.8:cert11,16.8:cert12,16.8:cert13,16.8:cert2,16.8:cert3,16.8:cert4,16.8:cert4-rc1,16.8:cert4-rc2,16.8:cert4-rc3,16.8:cert4-rc4,16.8:cert5,16.8:cert6,16.8:cert7,16.8:cert8,16.8:cert9; Upgrade debian debian_linux to a higher version than 10.0,11.0,and avoid the version 10.0,11.0