certfr_avis - certfr-2025-avi-0446

CERTFR-2025-AVI-0446

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans Asterisk. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Asterisk	Asterisk	asterisk versions 18.26.x antérieures à 18.26.2
Asterisk	Asterisk	asterisk versions 21.9.x antérieures à 21.9.1
Asterisk	Asterisk	asterisk versions 20.7-certx antérieures à 20.7-cert5
Asterisk	Asterisk	asterisk versions 20.14.x antérieures à 20.14.1
Asterisk	Asterisk	asterisk versions 22.4.x antérieures à 22.4.1
Asterisk	Asterisk	asterisk versions 18.9-certx antérieures à 18.9-cert14

References

Title

Publication Time

Tags

Bulletin de sécurité Asterisk GHSA-c7p6-7mvq-8jq2	2025-05-22	vendor-advisory
Bulletin de sécurité Asterisk GHSA-2grh-7mhv-fcfw	2025-05-22	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "asterisk versions 18.26.x ant\u00e9rieures \u00e0 18.26.2",
      "product": {
        "name": "Asterisk",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    },
    {
      "description": "asterisk versions 21.9.x ant\u00e9rieures \u00e0 21.9.1",
      "product": {
        "name": "Asterisk",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    },
    {
      "description": "asterisk versions 20.7-certx ant\u00e9rieures \u00e0 20.7-cert5",
      "product": {
        "name": "Asterisk",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    },
    {
      "description": "asterisk versions 20.14.x ant\u00e9rieures \u00e0 20.14.1",
      "product": {
        "name": "Asterisk",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    },
    {
      "description": "asterisk versions 22.4.x ant\u00e9rieures \u00e0 22.4.1",
      "product": {
        "name": "Asterisk",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    },
    {
      "description": "asterisk versions 18.9-certx ant\u00e9rieures \u00e0 18.9-cert14",
      "product": {
        "name": "Asterisk",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-47780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-47780"
    },
    {
      "name": "CVE-2025-47779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-47779"
    }
  ],
  "initial_release_date": "2025-05-23T00:00:00",
  "last_revision_date": "2025-05-23T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0446",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Asterisk. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Asterisk",
  "vendor_advisories": [
    {
      "published_at": "2025-05-22",
      "title": "Bulletin de s\u00e9curit\u00e9 Asterisk GHSA-c7p6-7mvq-8jq2",
      "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-c7p6-7mvq-8jq2"
    },
    {
      "published_at": "2025-05-22",
      "title": "Bulletin de s\u00e9curit\u00e9 Asterisk GHSA-2grh-7mhv-fcfw",
      "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw"
    }
  ]
}

CVE-2025-47780 (GCVE-0-2025-47780)

Vulnerability from cvelistv5

Published

2025-05-22 16:56

Modified

2025-05-22 17:25

Severity ?

4.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring `cli_permissions.conf` (e.g. with the config line `deny=!*`) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.

References

URL

Tags

https://github.com/asterisk/asterisk/security/advisories/GHSA-c7p6-7mvq-8jq2

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	asterisk	asterisk	Version: < 18.9-cert14 Version: >= 18.10, < 18.26.2 Version: >= 20.0, < 20.7-cert5 Version: >= 20.8, < 20.14.1 Version: >= 21.0, < 21.9.1 Version: >= 22.0, < 22.4.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47780",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T17:24:44.875844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T17:25:09.045Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "asterisk",
          "vendor": "asterisk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 18.9-cert14"
            },
            {
              "status": "affected",
              "version": "\u003e= 18.10, \u003c 18.26.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0, \u003c 20.7-cert5"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.8, \u003c 20.14.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0, \u003c 21.9.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0, \u003c 22.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring `cli_permissions.conf` (e.g. with the config line `deny=!*`) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T16:56:28.937Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-c7p6-7mvq-8jq2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-c7p6-7mvq-8jq2"
        }
      ],
      "source": {
        "advisory": "GHSA-c7p6-7mvq-8jq2",
        "discovery": "UNKNOWN"
      },
      "title": "cli_permissions.conf: deny option does not work for disallowing shell commands"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47780",
    "datePublished": "2025-05-22T16:56:28.937Z",
    "dateReserved": "2025-05-09T19:49:35.620Z",
    "dateUpdated": "2025-05-22T17:25:09.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-47779 (GCVE-0-2025-47779)

Vulnerability from cvelistv5

Published

2025-05-22 16:54

Modified

2025-05-22 17:26

Severity ?

7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

CWE

CWE-140 - Improper Neutralization of Delimiters
CWE-792 - Incomplete Filtering of One or More Instances of Special Elements

Summary

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.

References

URL

Tags

	https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw	x_refsource_CONFIRM
	https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	asterisk	asterisk	Version: < 18.9-cert14 Version: >= 18.10, < 18.26.2 Version: >= 20.0, < 20.7-cert5 Version: >= 20.8, < 20.14.1 Version: >= 21.0, < 21.9.1 Version: >= 22.0, < 22.4.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47779",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T17:25:58.891881Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T17:26:57.260Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "asterisk",
          "vendor": "asterisk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 18.9-cert14"
            },
            {
              "status": "affected",
              "version": "\u003e= 18.10, \u003c 18.26.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0, \u003c 20.7-cert5"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.8, \u003c 20.14.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0, \u003c 21.9.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0, \u003c 22.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-140",
              "description": "CWE-140: Improper Neutralization of Delimiters",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-792",
              "description": "CWE-792: Incomplete Filtering of One or More Instances of Special Elements",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T16:54:26.314Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw"
        },
        {
          "name": "https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample"
        }
      ],
      "source": {
        "advisory": "GHSA-2grh-7mhv-fcfw",
        "discovery": "UNKNOWN"
      },
      "title": "Using malformed From header can forge identity with \";\" or NULL in name portion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47779",
    "datePublished": "2025-05-22T16:54:26.314Z",
    "dateReserved": "2025-05-09T19:49:35.620Z",
    "dateUpdated": "2025-05-22T17:26:57.260Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2025-AVI-0446

Vulnerability from certfr_avis

Solutions

CVE-2025-47780 (GCVE-0-2025-47780)

Vulnerability from cvelistv5

CVE-2025-47779 (GCVE-0-2025-47779)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature