CVE-2022-26651: Debian Linux

Critical severity, CVSS 9.8. EPSS: 7% chance of exploitation in the next 30 days.

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Digium Asterisk: from 16.0.0, before 16.25.2 (fixed in 16.25.2); from 18.0, before 18.11.2 (fixed in 18.11.2); from 19.0.0, before 19.3.2 (fixed in 19.3.2)
• Digium Certified Asterisk: version 16.8 only

Published 2022-04-15. Last modified 2026-06-17.