Bug 2531087

Summary: CVE-2026-57162 asterisk: stack overflow parsing SDP a=crypto attributes [fedora-all]
Product: [Fedora] Fedora Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: asteriskAssignee: Peter Lemenkov <lemenkov>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: urgent    
Version: rawhideCC: bennie.joubert, jsmith.fedora, lemenkov
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["6216996e-31a9-4251-bdd2-ddf6171e4fce"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-11 19:57:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2528778    

Description Guilherme de Almeida Suckevicz 2026-09-09 17:26:44 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. This is reachable from an incoming SIP INVITE during offer/answer, before application-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. Applications that do not enable SRTP are not affected. This issue has been patched via commit a1b707c.
Comment 1 Peter Lemenkov 2026-09-11 19:49:24 UTC 
Not applicable to Asterisk as built here.

This is a stack buffer overflow in sdes_encode_sdp() in transport_srtp_sdes.c, reached when processing a=crypto attributes during SDP offer/answer. The upstream advisory states it affects applications with SRTP enabled using SDES keying, and that applications which do not enable SRTP are not affected.

Asterisk disables pjproject's SRTP support in the bundled build. third-party/pjproject/patches/config_site.h sets PJMEDIA_HAS_SRTP to 0, and the bundled copy is configured with --disable-libsrtp and --without-external-srtp. Asterisk provides SRTP through its own res_srtp module instead.

Fixed upstream in pjproject commit a1b707c.
Comment 2 Peter Lemenkov 2026-09-11 19:57:16 UTC 
Closing as NOTABUG per the analysis above — pjproject's SRTP support is disabled in the bundled build, and Asterisk provides SRTP through its own res_srtp module.

As with the other pjproject CVEs in this batch, this is a build-configuration determination. It would need revisiting if the bundled build ever enabled pjproject's SRTP.