Fedora Account System
Red Hat Associate
Red Hat Customer
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Fuse's components camel-asterisk is a Camel client that communicates with an Asterisk PBX over AMI using asterisk-java, and camel-asterisk-starter is simply a Spring Boot starter that wraps this Camel component. However, CVE-2026-57193 affects Asterisk itself, specifically the res_config_ldap module, where LDAP filter injection can occur through crafted SIP usernames. The vulnerability is only applicable when this module is loaded and configured to use LDAP. Neither camel-asterisk nor camel-asterisk-starter ships Asterisk or the res_config_ldap module. Therefore, this is a name-related association only, and should not be considered affected by this CVE solely because of that association.