GCVE-1988-2026-0106

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Certified Asterisk Security",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asterisk Development Team via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Asterisk Development Team would like to announce security release  \nCertified Asterisk 20.7-cert11.\n\nThe release artifacts are available for immediate download at  \nhttps://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11\nand\nhttps://downloads.asterisk.org/pub/telephony/certified-asterisk\n\nRepository: https://github.com/asterisk/asterisk\nTag: certified-20.7-cert11\n\n\n## Change Log for Release asterisk-certified-20.7-cert11\n\n### Links:\n\n - [Full \nChangeLog](https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-20.7-cert11.html)\n  \n - [GitHub Diff](https://github.com/asterisk/asterisk/compare/certified-20.7-cert10...certified-20.7-cert11)  \n - [Tarball](https://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-20.7-cert11.tar.gz)  \n - [Downloads](https://downloads.asterisk.org/pub/telephony/certified-asterisk)  \n\n### Summary:\n\n- Commits: 18\n- Commit Authors: 7\n- Issues Resolved: 0\n- Security Advisories Resolved: 18\n  - [GHSA-3g56-cgrh-95p5](https://github.com/asterisk/asterisk/security/advisories/GHSA-3g56-cgrh-95p5): chan_unistim \nDIALPAGE digit handling can overflow phone_number and crash Asterisk\n  - [GHSA-3rhj-hhw7-m6fw](https://github.com/asterisk/asterisk/security/advisories/GHSA-3rhj-hhw7-m6fw): NULL Pointer \nDereference in HTTP AMI Digest Authentication\n  - [GHSA-4pgv-j3mr-3rcp](https://github.com/asterisk/asterisk/security/advisories/GHSA-4pgv-j3mr-3rcp): Reflected XSS \nin Phone Provisioning HTTP Error Pages\n  - [GHSA-589g-qgf8-m6mx](https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx): Stack buffer \noverflow in MWI NOTIFY Message-Account parsing\n  - [GHSA-746q-794h-cc7f](https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f): Out-of-Bounds \nRead in Q.931 Information Element Parser (H.323 Addon)\n  - [GHSA-8jhw-m2hg-vp3h](https://github.com/asterisk/asterisk/security/advisories/GHSA-8jhw-m2hg-vp3h): Heap Buffer \nOverflow in OGG/Speex File Playback (format_ogg_speex)\n  - [GHSA-8jw3-ccr9-xrmf](https://github.com/asterisk/asterisk/security/advisories/GHSA-8jw3-ccr9-xrmf): Buffer \nover-read in Asterisk PJSIP MWI body parser\n  - [GHSA-g8q2-p36q-94f6](https://github.com/asterisk/asterisk/security/advisories/GHSA-g8q2-p36q-94f6): \nHeap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing\n  - [GHSA-j2mm-57pq-jh94](https://github.com/asterisk/asterisk/security/advisories/GHSA-j2mm-57pq-jh94): Possible RED \nT.140 Generation Accumulation OOB Write\n  - [GHSA-mxgm-8c6f-5p8f](https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f): Stack buffer \noverflow in res_xmpp XMPP namespace prefix handling\n  - [GHSA-ph27-3m5q-mj5m](https://github.com/asterisk/asterisk/security/advisories/GHSA-ph27-3m5q-mj5m): SQL Injection \nin cel_pgsql and cel_tds via CELGenUserEvent eventtype Field\n  - [GHSA-q9fr-m7g8-6ph5](https://github.com/asterisk/asterisk/security/advisories/GHSA-q9fr-m7g8-6ph5): Asterisk \napp_sms.c copies externally controlled SMS lengths into fixed in-struct buffers\n  - [GHSA-qf8j-jp7h-c5hx](https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx): Out-of-Bounds \nWrite in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch\n  - [GHSA-r6c2-hwc2-j4mp](https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp): LDAP Filter \nInjection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)\n  - [GHSA-vfhr-r9x9-c687](https://github.com/asterisk/asterisk/security/advisories/GHSA-vfhr-r9x9-c687): Possible RED \nT.140 Heap Buffer Overflow\n  - [GHSA-vrfp-mg3q-3959](https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959): ARI \nsetChannelVar bypasses live_dangerously and permits FILE() writes\n  - [GHSA-x348-j6c9-77f3](https://github.com/asterisk/asterisk/security/advisories/GHSA-x348-j6c9-77f3): Stack Buffer \nOverflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer\n  - [GHSA-xgj6-2gc5-5x9c](https://github.com/asterisk/asterisk/security/advisories/GHSA-xgj6-2gc5-5x9c): ast_loggrabber \nexecutes python script in world writable directory(`/tmp`) leading to potential privilege escalation And RCE\n\n### User Notes:\n\n\n### Upgrade Notes:\n\n\n### Developer Notes:\n\n- #### ARI: Make ARI applications respect live_dangerously.\n  ARI applications can no longer call \"dangerous\" dialplan\n  functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without\n  enabling \"live_dangerously\" in asterisk.conf.\n  Resolves: #GHSA-vrfp-mg3q-3959\n\n\n### Commit Authors:\n\n- George Joseph: (5)\n- Joshua C. Colp: (1)\n- Mike Bradeen: (2)\n- Milan Kyselica: (7)\n- Pengpeng Hou: (1)\n- Roberto Paleari: (1)\n- ThatTotallyRealMyth: (1)\n\n## Issue and Commit Detail:\n\n### Closed Issues:\n\n  - !GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk\n  - !GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication\n  - !GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages\n  - !GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing\n  - !GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)\n  - !GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)\n  - !GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser\n  - !GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP \nprocessing\n  - !GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write\n  - !GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling\n  - !GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field\n  - !GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers\n  - !GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch\n  - !GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information \nDisclosure)\n  - !GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow\n  - !GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes\n  - !GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer\n  - !GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(`/tmp`) leading to \npotential privilege escalation And RCE\n\n### Commits By Author:\n\n- #### George Joseph (5):\n  - chan_unistim.c: Prevent overrun of phone_number field.\n  - pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.\n  - ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.\n  - ARI: Make ARI applications respect live_dangerously.\n  - res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.\n\n- #### Joshua C. Colp (1):\n  - build: Fix GCC discarded-qualifiers const errors.\n\n- #### Mike Bradeen (2):\n  - manager: Use remote address in user error logging\n  - ooh323: Prevent potential buffer overflow in trace logging\n\n- #### Milan Kyselica (7):\n  - res_xmpp: Fix stack buffer overflow in namespace prefix handling\n  - res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser\n  - res_config_ldap: Escape LDAP filter values per RFC 4515\n  - cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection\n  - http: Escape error page text to prevent reflected XSS\n  - codec_codec2: Only process complete Codec2 frames in decoder\n  - format_ogg_speex: Add bounds check to prevent heap buffer overflow\n\n- #### Pengpeng Hou (1):\n  - app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers\n\n- #### Roberto Paleari (1):\n  - res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser\n\n- #### ThatTotallyRealMyth (1):\n  - ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.\n\n### Commit List:\n\n-  ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.\n-  chan_unistim.c: Prevent overrun of phone_number field.\n-  pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.\n-  ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.\n-  ARI: Make ARI applications respect live_dangerously.\n-  res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.\n-  res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser\n-  manager: Use remote address in user error logging\n-  ooh323: Prevent potential buffer overflow in trace logging\n-  app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers\n-  res_xmpp: Fix stack buffer overflow in namespace prefix handling\n-  res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser\n-  res_config_ldap: Escape LDAP filter values per RFC 4515\n-  cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection\n-  http: Escape error page text to prevent reflected XSS\n-  codec_codec2: Only process complete Codec2 frames in decoder\n-  format_ogg_speex: Add bounds check to prevent heap buffer overflow\n-  build: Fix GCC discarded-qualifiers const errors.\n\n### Commit Details:\n\n#### ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.\n  Author: ThatTotallyRealMyth\n  Date:   2026-03-19\n\n  The ast_tsconvert.py script called by ast_loggrabber is now installed in a\n  temporary directory that isn't world readable or writable.\n\n  Resolves: #GHSA-xgj6-2gc5-5x9c\n\n#### chan_unistim.c: Prevent overrun of phone_number field.\n  Author: George Joseph\n  Date:   2026-06-15\n\n  Add a check to key_dial_page() to ensure that dialed digits won't overrun\n  the phone_number field.\n\n  Resolves: #GHSA-3g56-cgrh-95p5\n\n#### pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.\n  Author: George Joseph\n  Date:   2026-06-10\n\n  The filter_on_tx_message() function was using pj_strassign() to save the pointer\n  of the pjproject transport local address to a local pj_str_t variable.  That\n  variable was ultimately used to set the Contact header's uri->host and the SDP\n  connection attribute's address again using pj_strassign.  pj_strassign() doesn't\n  copy the actual value of the pj_str_t however, it just copies the pointer so\n  if a connection-oriented transport is disconnected before the 200 OK with the\n  SDP is sent, those pointers will be invalid which can cause use-after-free\n  issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the\n  tdata->pool as the backing store to save the local IP address to the local\n  variable.  pj_strassign() can then be used safely later on since the tdata\n  will be available for the life of the transaction.\n\n  Resolves: #GHSA-g8q2-p36q-94f6\n\n#### ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.\n  Author: George Joseph\n  Date:   2026-06-02\n\n  Several bounds checks have been edded to ooQ931Decode to prevent it from\n  running past the end of the data buffer when parsing information elements.\n\n  Resolves: #GHSA-746q-794h-cc7f\n\n#### ARI: Make ARI applications respect live_dangerously.\n  Author: George Joseph\n  Date:   2026-05-21\n\n  DeveloperNote: ARI applications can no longer call \"dangerous\" dialplan\n  functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without\n  enabling \"live_dangerously\" in asterisk.conf.\n\n  Resolves: #GHSA-vrfp-mg3q-3959\n\n#### res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.\n  Author: George Joseph\n  Date:   2026-04-27\n\n  * Add check to red_t140_to_red() to ensure that the new primary payload\n  can't cause the rtp_red->len array items to wrap or cause an overrun of\n  the rtp_red->t140red_data buffer.\n\n  * Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent\n  can't cause rtp_red->len array items to wrap or cause an overrun of\n  the rtp_red->buf_data buffer.\n\n  Resolves: #GHSA-vfhr-r9x9-c687\n  Resolves: #GHSA-j2mm-57pq-jh94\n\n#### res"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/1"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-20.7-cert11.tar.gz"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-20.7-cert11.html"
        },
        {
          "url": "https://github.com/asterisk/asterisk"
        },
        {
          "url": "https://github.com/asterisk/asterisk/compare/certified-20.7-cert10...certified-20.7-cert11"
        },
        {
          "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-3g56-cgrh-95p5"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-3rhj-hhw7-m6fw"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-4pgv-j3mr-3rcp"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-8jhw-m2hg-vp3h"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-8jw3-ccr9-xrmf"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-g8q2-p36q-94f6"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-j2mm-57pq-jh94"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-ph27-3m5q-mj5m"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-q9fr-m7g8-6ph5"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vfhr-r9x9-c687"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-x348-j6c9-77f3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-xgj6-2gc5-5x9c"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Certified Asterisk Security Release certified-20.7-cert11",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0106",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/1",
            "automated": true,
            "contentSha256": "33e321af68b39ad863250cc1696071890df3f94da280f82802e86a7366e1b043",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-25T17:08:07Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0106"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}