Bug 2531081

Summary:	CVE-2026-57160 asterisk: SIP message header buffer overflow [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	asterisk	Assignee:	EPEL Packagers SIG <epel-packagers-sig>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	epel10	CC:	bennie.joubert, epel-packagers-sig, jsmith.fedora, lemenkov
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["da40773a-b724-48c4-8cfc-0048cf04bba9"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2528767

Description Guilherme de Almeida Suckevicz 2026-09-09 17:25:47 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Allow, Require, Supported, and Unsupported). Under certain output-buffer boundary conditions the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests — for example a proxy, SBC, or B2BUA — where a remote peer can influence the serialized message. The out-of-bounds write is a single fixed byte; code execution and information disclosure are not demonstrated, and in typical pool-based allocations the byte falls within allocation slack. This issue has been patched via commit d6a0e7f.

Comment 1 Peter Lemenkov 2026-09-11 19:49:05 UTC

This one does apply.

The flaw is a buffer overflow in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers such as Allow, Require, Supported and Unsupported. Unlike the other pjproject CVEs filed against asterisk in this batch, it carries no gating condition, so the bundled copy is affected.

The bundled pjproject is 2.17, which predates the fix (pjproject commit d6a0e7f).

For context on severity, the upstream advisory describes the out-of-bounds write as a single fixed byte, notes that code execution and information disclosure are not demonstrated, and observes that in typical pool-based allocations the byte falls within allocation slack.

Same determination as the Fedora tracker, bug 2531080.