FEDORA-EPEL-2026-ba6e61f1d3
Packages in this update:
Update description:
Security update: backport upstream Asterisk security fixes to 18.26.4.
Fixes for the bundled pjproject 2.15.1:
- CVE-2026-41415: out-of-bounds read on a malformed Content-ID URI in SIP
multipart bodies
- CVE-2026-41416: integer overflow in the audio stream buffer size with an
asymmetric ptime configuration
- CVE-2026-57160: one-byte heap overflow when printing generic array headers
- CVE-2026-84975: TLS server impersonation via an embedded NUL in a DNS
SubjectAltName (OpenSSL and GnuTLS backends)
- CVE-2026-25994: heap buffer overflow in ICE with a long username
- CVE-2026-28799: use-after-free in presence subscription termination
- CVE-2026-32942: ICE session use-after-free race conditions
- CVE-2026-33069: out-of-bounds read in SIP multipart parsing
Fixes from the Asterisk 20.20.1 security release:
- CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS)
- CVE-2026-57191: PJSIP MWI NOTIFY Message-Account stack buffer overflow
- CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE
- CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk
- CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds
- CVE-2026-57193: LDAP filter injection in res_config_ldap
- CVE-2026-57194: chan_unistim out-of-bounds write
- CVE-2026-57195: AMI HTTP digest authentication NULL dereference
- CVE-2026-57196: reflected XSS in HTTP error pages
- CVE-2026-57197: format_ogg_speex heap buffer overflow
- CVE-2026-57199: app_sms buffer overflow
- CVE-2026-57202: ARI setChannelVar bypassed live_dangerously
- CVE-2026-57203: ast_loggrabber executed a helper script from /tmp
Fixes from the Asterisk 20.18.2 security release:
- CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default)
- CVE-2026-23739: XML parsing with external entity expansion
- CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely
- CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user
/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug
scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it
as root unless it is root-owned and not group- or world-writable.
Security update: backport upstream Asterisk security fixes to 18.26.4.
Fixes from the Asterisk 20.20.1 security release:
- CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS)
- CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE
- CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk
- CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds
- CVE-2026-57193: LDAP filter injection in res_config_ldap
- CVE-2026-57194: chan_unistim out-of-bounds write
- CVE-2026-57195: AMI HTTP digest authentication NULL dereference
- CVE-2026-57196: reflected XSS in HTTP error pages
- CVE-2026-57197: format_ogg_speex heap buffer overflow
- CVE-2026-57199: app_sms buffer overflow
- CVE-2026-57202: ARI setChannelVar bypassed live_dangerously
- CVE-2026-57203: ast_loggrabber executed a helper script from /tmp
Fixes from the Asterisk 20.18.2 security release:
- CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default)
- CVE-2026-23739: XML parsing with external entity expansion
- CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely
- CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user
/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug
scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it
as root unless it is root-owned and not group- or world-writable.
