CVE-2025-57767: sangoma asterisk

csirt@kutim:~/threat-intel/cve/CVE-2025-57767

CVSS 7.5 · High EPSS 0,41%

Kerentanan Incorrect Check of Function Return Value pada sangoma asterisk. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header with an incorrect realm was received without a previous 401 response being sent, the get_authorization_header() function in res_pjsip_authenticator_digest will return a NULL. This wasn't being checked before attempting to get the digest algorithm from the header which causes a SEGV. This issue has been patched in versions 20.15.2, 21.10.2, and 22.5.2. There are no workarounds.

Rincian

Terbit di NVD: 28 Agustus 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-253: Incorrect Check of Function Return Value
EPSS (30 hari): 0,41% peluang dieksploitasi; lebih tinggi dari 33,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sangoma	asterisk	Semua versi sebelum 20.15.2
sangoma	asterisk	Versi 21.0.0 hingga sebelum 21.10.2
sangoma	asterisk	Versi 22.0.0 hingga sebelum 22.5.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/asterisk/asterisk/security/advisories/GHSA-64qc-9x89-rx5j advisory vendor
https://github.com/asterisk/asterisk/commit/02993717b08f899d4aca9888062f35dfb198584f patch
https://github.com/asterisk/asterisk/pull/1407 issue tracking · patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.