Source: asterisk Version: 1:22.10.1+dfsg+~cs6.17.60671434-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi Jonas, The following vulnerabilities were published for asterisk. They are all in the PJSIP part and AFAIK not yet in a tagged PJSIP release. The security-tracker contains references to the fixes, can you double-check please? CVE-2026-57159[0]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to commit 673b978, a remote out-of-bounds read | and write can occur in the SDP negotiator when the remote payload- | type map maintenance feature is enabled. assign_pt_and_update_map() | in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken | from a remote SDP offer or answer to index fixed-size internal | tables without sufficient bounds validation, so a crafted remote SDP | can cause memory access outside those tables. The practical impact | is memory corruption and denial of service; code execution is not | demonstrated. This path is only reached when | PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled. The default is | disabled, so default builds are not affected; the feature is an | interoperability option that integrating products may enable. This | issue has been patched via commit 673b978. CVE-2026-57160[1]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to commit d6a0e7f, a buffer overflow can occur | in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the | function that serializes generic array headers (such as Allow, | Require, Supported, and Unsupported). Under certain output-buffer | boundary conditions the function can write one byte past the end of | the buffer. This is reachable mainly in applications that parse and | re-serialize incoming SIP requests — for example a proxy, SBC, or | B2BUA — where a remote peer can influence the serialized message. | The out-of-bounds write is a single fixed byte; code execution and | information disclosure are not demonstrated, and in typical pool- | based allocations the byte falls within allocation slack. This issue | has been patched via commit d6a0e7f. CVE-2026-57161[2]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to commit acc03b5, a stack buffer overflow | exists in PJSUA when processing Service-Route headers in a | registration response (update_service_route() in pjsua_acc.c). This | affects applications that register using the PJSUA/PJSUA2 account | API (the default registration path). The Service-Route URIs from a | 2xx response to REGISTER are stored into a fixed-size array without | bounding the number of headers; a registrar that returns an | excessive number of Service-Route headers can write past the end of | the array on the stack. The values written are internal pointers | rather than arbitrary data, so the most likely impact is unexpected | application termination (denial of service), though memory | corruption cannot be excluded. The malicious response may come from | a compromised or malicious registrar, or — over unprotected | transports — a spoofed response. This issue has been patched via | commit acc03b5. CVE-2026-57162[3]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to commit a1b707c, a stack buffer overflow | exists in the SRTP/SDES media transport when processing a=crypto | attributes during SDP offer/answer (sdes_encode_sdp() in | transport_srtp_sdes.c). This affects applications with SRTP enabled | (use_srtp optional or mandatory, using SDES keying). During media | negotiation, the crypto attributes from the remote SDP are collected | into a fixed-size array without bounding their number; a remote peer | that includes an excessive number of a=crypto attributes in a single | media description can write past the end of that array on the stack. | This is reachable from an incoming SIP INVITE during offer/answer, | before application-level authentication. Impact may range from | unexpected application termination to control flow hijack/memory | corruption. Applications that do not enable SRTP are not affected. | This issue has been patched via commit a1b707c. CVE-2026-57163[4]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to commit c4a151a, a stack buffer overflow | exists in the GnuTLS TLS backend when parsing the Subject | Alternative Name extension of a peer certificate | (tls_cert_get_info() in ssl_sock_gtls.c). Only GnuTLS builds are | affected (--with-gnutls); OpenSSL and Apple | SecureTransport/Network.framework builds are not affected. While | extracting certificate information after a TLS handshake, an | incorrect buffer-size value can cause an oversized SubjectAltName | entry to be written past the end of a fixed-size stack buffer. A | network-positioned attacker presenting a crafted certificate — a | malicious server to a connecting client, or a malicious client to a | server that requests certificates — can trigger this during the TLS | handshake, before any SIP-level authentication. Impact may range | from unexpected application termination to control flow | hijack/memory corruption. This issue has been patched via commit | c4a151a. CVE-2026-57164[5]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to commit 8d5956a, a heap buffer overflow exists | in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP | response body. This affects applications that use the PJLIB-UTIL | HTTP client to receive a whole response body at once (a completion | callback with no incremental on_data_read callback). When growing | the response buffer, an incorrect size calculation based on the | server-supplied Content-Length can leave the buffer too small, | causing response data to be written past the end of the allocation. | A malicious or man-in-the-middle HTTP server can trigger this with a | crafted response; impact may range from unexpected application | termination to memory corruption. Applications that consume the | response incrementally (via on_data_read), or that only connect to | trusted servers, are not affected. This issue has been patched via | commit 8d5956a. CVE-2026-57165[6]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to commit 628b716, a stack buffer overflow | exists in the PJLIB-UTIL telnet CLI front-end when redrawing the | command line during history recall (handle_up_down() in | cli_telnet.c). This affects only applications that enable the telnet | CLI front-end (same gating as the related CLI issue). The line- | redraw sequence for a recalled history entry can accumulate more | data than a fixed-size stack buffer holds, which may lead to | application termination. Exploitation requires access to the | unauthenticated telnet CLI, which already permits arbitrary CLI | commands, so the additional impact is limited. Applications that do | not enable the telnet CLI front-end are not affected. This issue has | been patched via commit 628b716. CVE-2026-57166[7]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to commit 4472a31, a stack buffer overflow | exists in the PJLIB-UTIL telnet CLI front-end when rendering | feedback for an entered command line. Several command-line handling | paths write an attacker-influenced amount of data into fixed-size | buffers without sufficient bounds checking, so a long command line | can overflow them. This affects only applications that enable the | telnet CLI front-end (e.g. pj_cli_telnet_create() / --cli-telnet- | port). The telnet CLI is an interactive administration interface | with no authentication, so any client able to reach it can already | issue arbitrary CLI commands. A malformed or overly long command | line can overflow a fixed-size stack buffer while rendering command- | line feedback, which may lead to application termination. Because | reaching this code already requires access to the unauthenticated | CLI, the impact beyond that existing access is limited. Applications | that do not enable the telnet CLI front-end are not affected. This | issue has been patched via commit 4472a31. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-57159 https://www.cve.org/CVERecord?id=CVE-2026-57159 [1] https://security-tracker.debian.org/tracker/CVE-2026-57160 https://www.cve.org/CVERecord?id=CVE-2026-57160 [2] https://security-tracker.debian.org/tracker/CVE-2026-57161 https://www.cve.org/CVERecord?id=CVE-2026-57161 [3] https://security-tracker.debian.org/tracker/CVE-2026-57162 https://www.cve.org/CVERecord?id=CVE-2026-57162 [4] https://security-tracker.debian.org/tracker/CVE-2026-57163 https://www.cve.org/CVERecord?id=CVE-2026-57163 [5] https://security-tracker.debian.org/tracker/CVE-2026-57164 https://www.cve.org/CVERecord?id=CVE-2026-57164 [6] https://security-tracker.debian.org/tracker/CVE-2026-57165 https://www.cve.org/CVERecord?id=CVE-2026-57165 [7] https://security-tracker.debian.org/tracker/CVE-2026-57166 https://www.cve.org/CVERecord?id=CVE-2026-57166 Regards, Salvatore
