SB2026110241 - Fedora 43 update for asterisk
Published: November 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2026-57196)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser and impersonate an authorized user.
The vulnerability exists due to cross-site scripting in Phone Provisioning HTTP error pages when handling crafted HTTP requests. A remote attacker can send a malicious link to a victim to execute arbitrary script in the victim's browser and impersonate an authorized user.
User interaction is required, and exploitation is possible only when the res_phoneprov module is enabled and the HTTP server and AMI over HTTP are enabled.
2) Incorrect default permissions (CVE-ID: CVE-2026-23741)
CWE-ID: CWE-276 - Incorrect Default Permissions
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect default permissions for the "/etc/asterisk/ast_debug_tools.conf" file, which is writable by the asterisk user:group and is used by the "asterisk/contrib/scripts/ast_coredumper". A local user can modify the file and execute arbitrary OS commands as root.
3) Insecure library loading (CVE-ID: CVE-2026-23740)
CWE-ID: CWE-427 - Uncontrolled Search Path Element
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the application loads dynamic libraries in an insecure manner from the /tmp directory. A local user can place a specially crafted library file into the /tmp directory and execute arbitrary code on the system with root privileges.
4) XML External Entity injection (CVE-ID: CVE-2026-23739)
CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N]
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied XML input within the ast_xml_open() function in xml.c. A remote privileged user can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.
The vendor underlines that Asterisk currently doesn't allow untrusted or user-supplied XML to be used but a fix should be made in case that changes in the future.
5) Cross-site scripting (CVE-ID: CVE-2026-23738)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to the "/httpstatus" page echos cookies and query string without sanitization. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
6) Untrusted search path (CVE-ID: CVE-2026-57203)
CWE-ID: CWE-426 - Untrusted Search Path
CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to untrusted search path in the ast_loggrabber script when executing a python script from the /tmp directory. A local user can place a malicious script in /tmp to escalate privileges.
Exploitation requires prior shell access on the Asterisk server and an administrator to run the ast_loggrabber script with elevated privileges.
7) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-57202)
CWE-ID: CWE-1220 - Insufficient Granularity of Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform unauthorized file writes.
The vulnerability exists due to insufficient granularity of access control in the ARI setChannelVar functionality when handling requests to set channel variables using the FILE() dialplan function. A remote user can send a specially crafted request to perform unauthorized file writes.
The Asterisk HTTP webserver must be enabled, and the issue is reachable only if the attacker can connect to that server. Valid read-only ARI credentials are required.
8) Out-of-bounds write (CVE-ID: CVE-2026-57199)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory or cause a denial of service.
The vulnerability exists due to out-of-bounds write in app_sms when processing externally controlled SMS lengths. A remote attacker can supply crafted SMS length values to corrupt memory or cause a denial of service.
The issue is exposed only when the SMS dialplan application is explicitly used for routing calls to or from analog devices.
9) Heap-based buffer overflow (CVE-ID: CVE-2026-57197)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in format_ogg_speex when processing a crafted OGG/Speex audio file. A local user can provide a file containing corrupted speex data to cause a denial of service.
Asterisk must be configured to play the file, and exploitation requires the ability to make the crafted file available to the system or to convince an administrator to do so.
10) Buffer over-read (CVE-ID: CVE-2026-57185)
CWE-ID: CWE-126 - Buffer over-read
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the PJSIP MWI body parser when handling a crafted SIP NOTIFY request. A remote user can send a specially crafted SIP NOTIFY request to cause a denial of service.
The attacker must be able to pass SIP authentication either by username and password or by source IP address matching.
11) NULL pointer dereference (CVE-ID: CVE-2026-57195)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the http ami digest authentication handler when processing crafted HTTP requests for AMI digest authentication. A remote attacker can send a specially crafted HTTP request to cause a denial of service.
The issue is exploitable only when the Asterisk HTTP web server is enabled, the Asterisk Manager Interface is enabled, and access to the AMI via HTTP is enabled.
12) Out-of-bounds write (CVE-ID: CVE-2026-57194)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the chan_unistim DIALPAGE digit handling for the phone_number buffer when processing a crafted incoming UNISTIM request packet. A remote user can send a carefully crafted incoming request packet to cause a denial of service.
The chan_unistim module must be loaded and configured with a valid UNISTIM UDP port, and exploitation requires registering as a configured phone MAC or using an equivalent provisioning path that allows a client to reach the main page.
13) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: CVE-2026-57193)
CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper neutralization of special elements in data query logic in the res_config_ldap realtime driver when processing crafted SIP packets containing a SIP username. A remote attacker can send specially crafted SIP packets to disclose sensitive information.
The issue is exposed only when the res_config_ldap module is loaded and configured to access an LDAP server.
14) SQL injection (CVE-ID: CVE-2026-57190)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary SQL commands.
The vulnerability exists due to SQL injection in the CELGenUserEvent eventtype field in the cel_pgsql and cel_tds Channel Event Log backends when processing untrusted event data. A remote user can supply a crafted eventtype value to execute arbitrary SQL commands.
The issue is exposed only when the cel_pgsql or cel_tds backend is loaded and configured and the dialplan uses the CELGenUserEvent application.
15) Heap-based buffer overflow (CVE-ID: CVE-2026-57198)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code or cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the T.140 RED handling in chan_sip when processing carefully crafted packets. A remote user can send specially crafted packets to execute arbitrary code or cause a denial of service.
Only systems using the chan_sip channel driver with the textsupport option enabled are vulnerable.
16) Out-of-bounds write (CVE-ID: CVE-2026-57189)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code or cause a denial of service.
The vulnerability exists due to out-of-bounds write in T.140 RED generation handling when processing carefully crafted packets. A remote user can send carefully crafted packets to execute arbitrary code or cause a denial of service.
Only systems using the chan_sip channel driver with the textsupport option enabled are vulnerable.
17) Use-after-free (CVE-ID: CVE-2026-57187)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to use-after-free in PJSIP TCP/SDP handling when processing a SIP INVITE over a connection-oriented transport and the TCP connection closes during SDP processing. A remote user can send a specially crafted SIP INVITE and disconnect before Asterisk responds with the 200 OK to cause a denial of service.
The issue has only been reproduced when Address Sanitizer is enabled.
Remediation
Install update from vendor's website.