Unrated
Security advisory
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-26651
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 03:46 UTC · Revision 1
Source evidence
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.
osv:CVE-2022-26651
Complete source record
{
"id": "776d83c5a67d2587d8b679ebd3edd554123233d04bc169468fe2cb4d1eed30dd",
"url": "https://osv.dev/vulnerability/CVE-2022-26651",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2022-26651",
"summary": "An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.",
"evidence": "osv:CVE-2022-26651",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2022-26651",
"aliases": [
"CVE-2022-26651"
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/asterisk/asterisk",
"type": "GIT",
"events": [
{
"introduced": "a65908f83e2f17a3aca7eb39c8e06045aca02674"
},
{
"fixed": "8898781851e446bd6eebb74592d8005e0511f1e1"
},
{
"introduced": "2c1bba3cbec008c8ce35c78a2c79f9f207ea58bc"
},
{
"fixed": "3e57d107467db7b5e4b64db75edf09641881c9fd"
},
{
"introduced": "de4f63b4824c91a0cd9f3d95f3b7923bec71960c"
},
{
"fixed": "91be429a41b9a9090e7e2b7b1efc9bea61571292"
},
{
"introduced": "d436f568583184a13aa46349af5a3f0907087b44"
},
{
"last_affected": "91b991f2427bf1f4deb82985b051fc93ee408fda"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "16.0.0"
},
{
"fixed": "16.25.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "18.0"
},
{
"fixed": "18.11.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "19.0.0"
},
{
"fixed": "19.3.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:-:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-NA"
},
{
"last_affected": "16.8-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert1\\-rc1"
},
{
"last_affected": "16.8-cert1\\-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert1\\-rc2"
},
{
"last_affected": "16.8-cert1\\-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert1\\-rc3"
},
{
"last_affected": "16.8-cert1\\-rc3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert1\\-rc4"
},
{
"last_affected": "16.8-cert1\\-rc4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert10:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert10"
},
{
"last_affected": "16.8-cert10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert11:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert11"
},
{
"last_affected": "16.8-cert11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert12:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert12"
},
{
"last_affected": "16.8-cert12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert13:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert13"
},
{
"last_affected": "16.8-cert13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert2:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert2"
},
{
"last_affected": "16.8-cert2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert3:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert3"
},
{
"last_affected": "16.8-cert3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert4:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert4"
},
{
"last_affected": "16.8-cert4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert4\\-rc1"
},
{
"last_affected": "16.8-cert4\\-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert4\\-rc2"
},
{
"last_affected": "16.8-cert4\\-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert4\\-rc3"
},
{
"last_affected": "16.8-cert4\\-rc3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert4\\-rc4"
},
{
"last_affected": "16.8-cert4\\-rc4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert5:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert5"
},
{
"last_affected": "16.8-cert5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert6:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert6"
},
{
"last_affected": "16.8-cert6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert7:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert7"
},
{
"last_affected": "16.8-cert7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert8:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert8"
},
{
"last_affected": "16.8-cert8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:digium:certified_asterisk:16.8:cert9:*:*:*:*:*:*",
"range": [
{
"introduced": "16.8-cert9"
},
{
"last_affected": "16.8-cert9"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"16.8-NA",
"16.8-cert10",
"16.8-cert11",
"16.8-cert12",
"16.8-cert13",
"16.8-cert1\\-rc1",
"16.8-cert1\\-rc2",
"16.8-cert1\\-rc3",
"16.8-cert1\\-rc4",
"16.8-cert2",
"16.8-cert3",
"16.8-cert4",
"16.8-cert4\\-rc1",
"16.8-cert4\\-rc2",
"16.8-cert4\\-rc3",
"16.8-cert4\\-rc4",
"16.8-cert5",
"16.8-cert6",
"16.8-cert7",
"16.8-cert8",
"16.8-cert9",
"certified/16.8-cert9",
"certified/16.8-cert8",
"certified/16.8-cert7",
"certified/16.8-cert6",
"certified/16.8-cert5",
"certified/16.8-cert4",
"certified/16.8-cert4-rc4",
"certified/16.8-cert4-rc3",
"certified/16.8-cert4-rc2",
"certified/16.8-cert4-rc1",
"certified/16.8-cert3",
"certified/16.8-cert2",
"certified/16.8-cert1",
"certified/16.8-cert1-rc5",
"certified/16.8-cert1-rc4",
"certified/16.8-cert1-rc3",
"certified/16.8-cert1-rc2",
"certified/16.8-cert1-rc1",
"16.8.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26651.json"
}
}
],
"modified": "2026-10-28T02:30:32.819047348Z",
"provider": "osv",
"references": [
"https://downloads.asterisk.org/pub/security/",
"https://downloads.asterisk.org/pub/security/AST-2022-003.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26651.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-26651",
"https://www.debian.org/security/2022/dsa-5285",
"https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26651.json"
}
},
"related_cves": [
{
"value": "CVE-2022-26651",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 500096,
"published_at": "2022-04-15T00:00:00+00:00"
}