Bug 2397954 - CVE-2025-1131 libpri: Asterisk Unsafe Shell Sourcing Leads to Local Privilege Escalation [epel-8]
Summary: CVE-2025-1131 libpri: Asterisk Unsafe Shell Sourcing Leads to Local Privilege...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: libpri
Version: epel8
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Ben Beasley
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["880a53d0-0e73-427a-a690-f...
Depends On:
Blocks: CVE-2025-1131
TreeView+ depends on / blocked
 
Reported: 2025-09-24 20:34 UTC by Jon Moroney
Modified: 2025-09-24 21:31 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-09-24 21:31:17 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jon Moroney 2025-09-24 20:34:41 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams

Comment 1 Ben Beasley 2025-09-24 21:31:17 UTC
Per https://www.cve.org/CVERecord?id=CVE-2025-1131:

> A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions. Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.

While libpri belongs to the Asterisk stack, it provides only a C shared library. It does not include the safe_asterisk script or any other shell scripts. It is therefore not affected by CVE-2025-1131.


Note You need to log in before you can comment on or make changes to this bug.