Bug 2561052 (CVE-2026-57193)

Summary:	CVE-2026-57193 asterisk: asterisk: Information disclosure via LDAP filter injection in res_config_ldap
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gmalinko, janstey, pdelbell, rstepani
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Asterisk's res_config_ldap module. An unauthenticated remote attacker can exploit this flaw to cause information disclosure through Lightweight Directory Access Protocol (LDAP) filter injection. By sending specially crafted Session Initiation Protocol (SIP) packets with a manipulated username, an attacker can execute arbitrary LDAP queries and retrieve sensitive directory data when the module is configured to connect to an LDAP server.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2564800, 2564801, 2564802, 2564804
Bug Blocks:

Description OSIDB Bzimport 2026-10-26 19:53:42 UTC

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Comment 5 Yadnyawalk Tale 2026-11-02 12:16:17 UTC

Fuse's components camel-asterisk is a Camel client that communicates with an Asterisk PBX over AMI using asterisk-java, and camel-asterisk-starter is simply a Spring Boot starter that wraps this Camel component.

However, CVE-2026-57193 affects Asterisk itself, specifically the res_config_ldap module, where LDAP filter injection can occur through crafted SIP usernames. The vulnerability is only applicable when this module is loaded and configured to use LDAP.

Neither camel-asterisk nor camel-asterisk-starter ships Asterisk or the res_config_ldap module.

Therefore, this is a name-related association only, and should not be considered affected by this CVE solely because of that association.