Bug 2254625 (CVE-2023-37457)

Summary: CVE-2023-37457 asterisk: potential buffer overflow in PJSIP_HEADER dialplan function
Product: [Other] Security Response Reporter: Robb Gatica <rgatica>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was discovered in Asterisk. In certain circumstances, a remote attacker may trigger a condition where available memory buffer space is exceeded. This may lead to a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2254626, 2254627    
Bug Blocks: 2254624    

Description Robb Gatica 2023-12-14 23:03:12 UTC 
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.

https://github.com/asterisk/asterisk/commit/a1ca0268254374b515fa5992f01340f7717113fa
https://github.com/asterisk/asterisk/security/advisories/GHSA-98rc-4j27-74hh
Comment 1 Robb Gatica 2023-12-14 23:03:28 UTC 
Created asterisk tracking bugs for this issue:

Affects: epel-all [bug 2254626]
Affects: fedora-all [bug 2254627]