SB20261104112 - Fedora 43 update for asterisk

Description

This security bulletin contains information about 26 vulnerabilities.

1) SQL injection (CVE-ID: CVE-2026-57190)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in the CELGenUserEvent eventtype field in the cel_pgsql and cel_tds Channel Event Log backends when processing untrusted event data. A remote user can supply a crafted eventtype value to execute arbitrary SQL commands.

The issue is exposed only when the cel_pgsql or cel_tds backend is loaded and configured and the dialplan uses the CELGenUserEvent application.

2) Incorrect default permissions (CVE-ID: CVE-2026-23741)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for the "/etc/asterisk/ast_debug_tools.conf" file, which is writable by the asterisk user:group and is used by the "asterisk/contrib/scripts/ast_coredumper". A local user can modify the file and execute arbitrary OS commands as root.

3) Insecure library loading (CVE-ID: CVE-2026-23740)

CWE-ID: CWE-427 - Uncontrolled Search Path Element

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the application loads dynamic libraries in an insecure manner from the /tmp directory. A local user can place a specially crafted library file into the /tmp directory and execute arbitrary code on the system with root privileges. 

4) XML External Entity injection (CVE-ID: CVE-2026-23739)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N]

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input within the ast_xml_open() function in xml.c. A remote privileged user can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

The vendor underlines that Asterisk currently doesn't allow untrusted or user-supplied XML to be used but a fix should be made in case that changes in the future.

5) Cross-site scripting (CVE-ID: CVE-2026-23738)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to the "/httpstatus" page echos cookies and query string without sanitization. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

6) Untrusted search path (CVE-ID: CVE-2026-57203)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to untrusted search path in the ast_loggrabber script when executing a python script from the /tmp directory. A local user can place a malicious script in /tmp to escalate privileges.

Exploitation requires prior shell access on the Asterisk server and an administrator to run the ast_loggrabber script with elevated privileges.

7) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-57202)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform unauthorized file writes.

The vulnerability exists due to insufficient granularity of access control in the ARI setChannelVar functionality when handling requests to set channel variables using the FILE() dialplan function. A remote user can send a specially crafted request to perform unauthorized file writes.

The Asterisk HTTP webserver must be enabled, and the issue is reachable only if the attacker can connect to that server. Valid read-only ARI credentials are required.

8) Out-of-bounds write (CVE-ID: CVE-2026-57199)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory or cause a denial of service.

The vulnerability exists due to out-of-bounds write in app_sms when processing externally controlled SMS lengths. A remote attacker can supply crafted SMS length values to corrupt memory or cause a denial of service.

The issue is exposed only when the SMS dialplan application is explicitly used for routing calls to or from analog devices.

9) Heap-based buffer overflow (CVE-ID: CVE-2026-57197)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in format_ogg_speex when processing a crafted OGG/Speex audio file. A local user can provide a file containing corrupted speex data to cause a denial of service.

Asterisk must be configured to play the file, and exploitation requires the ability to make the crafted file available to the system or to convince an administrator to do so.

10) Cross-site scripting (CVE-ID: CVE-2026-57196)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser and impersonate an authorized user.

The vulnerability exists due to cross-site scripting in Phone Provisioning HTTP error pages when handling crafted HTTP requests. A remote attacker can send a malicious link to a victim to execute arbitrary script in the victim's browser and impersonate an authorized user.

User interaction is required, and exploitation is possible only when the res_phoneprov module is enabled and the HTTP server and AMI over HTTP are enabled.

11) NULL pointer dereference (CVE-ID: CVE-2026-57195)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the http ami digest authentication handler when processing crafted HTTP requests for AMI digest authentication. A remote attacker can send a specially crafted HTTP request to cause a denial of service.

The issue is exploitable only when the Asterisk HTTP web server is enabled, the Asterisk Manager Interface is enabled, and access to the AMI via HTTP is enabled.

12) Out-of-bounds write (CVE-ID: CVE-2026-57194)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the chan_unistim DIALPAGE digit handling for the phone_number buffer when processing a crafted incoming UNISTIM request packet. A remote user can send a carefully crafted incoming request packet to cause a denial of service.

The chan_unistim module must be loaded and configured with a valid UNISTIM UDP port, and exploitation requires registering as a configured phone MAC or using an equivalent provisioning path that allows a client to reach the main page.

13) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: CVE-2026-57193)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper neutralization of special elements in data query logic in the res_config_ldap realtime driver when processing crafted SIP packets containing a SIP username. A remote attacker can send specially crafted SIP packets to disclose sensitive information.

The issue is exposed only when the res_config_ldap module is loaded and configured to access an LDAP server.

14) Out-of-bounds read (CVE-ID: CVE-2026-41415)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Content-ID URI parser when parsing a malformed Content-ID URI in a SIP multipart message body. A remote attacker can send a specially crafted SIP message with a multipart body to disclose sensitive information.

15) Heap-based buffer overflow (CVE-ID: CVE-2026-57198)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the T.140 RED handling in chan_sip when processing carefully crafted packets. A remote user can send specially crafted packets to execute arbitrary code or cause a denial of service.

Only systems using the chan_sip channel driver with the textsupport option enabled are vulnerable.

16) Out-of-bounds write (CVE-ID: CVE-2026-57189)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to out-of-bounds write in T.140 RED generation handling when processing carefully crafted packets. A remote user can send carefully crafted packets to execute arbitrary code or cause a denial of service.

Only systems using the chan_sip channel driver with the textsupport option enabled are vulnerable.

17) Use-after-free (CVE-ID: CVE-2026-57187)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in PJSIP TCP/SDP handling when processing a SIP INVITE over a connection-oriented transport and the TCP connection closes during SDP processing. A remote user can send a specially crafted SIP INVITE and disconnect before Asterisk responds with the 200 OK to cause a denial of service.

The issue has only been reproduced when Address Sanitizer is enabled.

18) Stack-based buffer overflow (CVE-ID: CVE-2026-57191)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in Message-Account parsing in res_pjsip_pubsub when handling a crafted MWI NOTIFY packet. A remote attacker can send a carefully crafted packet to cause a denial of service.

The issue can corrupt the underlying transport and permanently disable SIP functionality until the service is restarted.

19) Buffer over-read (CVE-ID: CVE-2026-57185)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the PJSIP MWI body parser when handling a crafted SIP NOTIFY request. A remote user can send a specially crafted SIP NOTIFY request to cause a denial of service.

The attacker must be able to pass SIP authentication either by username and password or by source IP address matching.

20) Out-of-bounds read (CVE-ID: CVE-2026-33069)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose adjacent heap memory.

The vulnerability exists due to an out-of-bounds read in pjsip_multipart_parse() when parsing SIP multipart bodies. A remote attacker can send a specially crafted SIP message to disclose adjacent heap memory.

Applications that process incoming SIP messages with multipart bodies or SDP content are potentially affected.

21) Use-after-free (CVE-ID: CVE-2026-32942)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the ICE session when race conditions occur between session destruction and callbacks. A remote attacker can trigger concurrent session destruction and callback execution to execute arbitrary code.

Any application using the ICE feature is potentially affected.

22) Use-after-free (CVE-ID: CVE-2026-28799)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the presence subscription termination handler. A remote attacker can execute arbitrary code on the target system.

23) Stack-based buffer overflow (CVE-ID: CVE-2026-25994)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in PJNATH ICE Session when processing credentials with excessively long usernames. A remote attacker can send crafted credentials with an excessively long username to cause a denial of service or execute arbitrary code.

This issue affects applications that use ICE.

24) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-84975)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to impersonate the target server and disclose sensitive information.

The vulnerability exists due to improper validation of certificate with host mismatch in the TLS server identity verification logic in the OpenSSL and GnuTLS backends when processing certificates with a DNS SubjectAltName containing an embedded NUL byte. A remote attacker can present a trusted certificate with a crafted embedded-NUL DNS SubjectAltName to impersonate the target server and disclose sensitive information.

Only applications using the PJSIP TLS or SIPS transport with server verification enabled are vulnerable, and mbedTLS-based deployments are not affected.

25) Off-by-one (CVE-ID: CVE-2026-57160)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an off-by-one error in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c when serializing generic array headers while re-serializing incoming SIP requests. A remote attacker can send a specially crafted SIP request to cause a denial of service.

This is primarily reachable in applications such as proxies, SBCs, or B2BUAs that parse and re-serialize incoming SIP messages.

26) Integer overflow (CVE-ID: CVE-2026-41416)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to integer overflow in media stream buffer size calculation in pjmedia media stream when processing SDP offers or answers with audio codec configurations that use asymmetric ptime. A remote attacker can send a specially crafted SDP offer or answer to cause a denial of service or execute arbitrary code.

Successful exploitation may result in an undersized buffer allocation and memory corruption.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2026-011a22de5e