Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-57767

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header with an incorrect realm was received without a previous 401 response being sent, the get_authorization_header() function in res_pjsip_authenticator_digest will return a NULL. This wasn't being checked before attempting to get the digest algorithm from the header which causes a SEGV. This issue has been patched in versions 20.15.2, 21.10.2, and 22.5.2. There are no workarounds.

Published

2025-08-28T16:15:35.410

Last Modified

2025-10-20T17:51:12.860

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-253
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sangoma asterisk < 20.15.2 Yes
Application sangoma asterisk < 21.10.2 Yes
Application sangoma asterisk < 22.5.2 Yes
References