Read the docs
TI-2023-19067 Aliases CVE-2023-37457

Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'

Priority LOW 38CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.

Why it matters now

EPSS 0.01116 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasteriskup to 18.20.0; 19.0.0 – 20.5.0; = 21.0.0; up to 18.9-cert5—No fix listedCNA
  • asterisk Vendorasterisk Affected up to 18.20.0; 19.0.0 – 20.5.0; = 21.0.0; up to 18.9-cert5 Fixed in — No fix listed CNA

CPE configurations NVD · 30

CPEVersionsRoleVendor
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*up to 18.20.0; 19.0.0 – 20.5.0VulnerableDigium
cpe:2.3:a:digium:asterisk:21.0.0:*:*:*:*:*:*:*21.0.0VulnerableDigium
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:*:*:*:*:*:*:*13.13.0VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1:*:*:*:*:*:*13.13.0 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc1:*:*:*:*:*:*13.13.0 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc2:*:*:*:*:*:*13.13.0 cert1-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc3:*:*:*:*:*:*13.13.0 cert1-rc3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc4:*:*:*:*:*:*13.13.0 cert1-rc4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert2:*:*:*:*:*:*13.13.0 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert3:*:*:*:*:*:*13.13.0 cert3VulnerableSangoma
  • cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:* Versions up to 18.20.0; 19.0.0 – 20.5.0 Vulnerable ·Digium
  • cpe:2.3:a:digium:asterisk:21.0.0:*:*:*:*:*:*:* Versions 21.0.0 Vulnerable ·Digium
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:*:*:*:*:*:*:* Versions 13.13.0 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1:*:*:*:*:*:* Versions 13.13.0 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc1:*:*:*:*:*:* Versions 13.13.0 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc2:*:*:*:*:*:* Versions 13.13.0 cert1-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc3:*:*:*:*:*:* Versions 13.13.0 cert1-rc3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert1-rc4:*:*:*:*:*:* Versions 13.13.0 cert1-rc4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert2:*:*:*:*:*:* Versions 13.13.0 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:cert3:*:*:*:*:*:* Versions 13.13.0 cert3 Vulnerable ·Sangoma
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc1:*:*:*:*:*:*13.13.0 rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc2:*:*:*:*:*:*13.13.0 rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:-:*:*:*:*:*:*16.8.0VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert1:*:*:*:*:*:*16.8.0 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert10:*:*:*:*:*:*16.8.0 cert10VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert11:*:*:*:*:*:*16.8.0 cert11VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert12:*:*:*:*:*:*16.8.0 cert12VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert2:*:*:*:*:*:*16.8.0 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert3:*:*:*:*:*:*16.8.0 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert4:*:*:*:*:*:*16.8.0 cert4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert5:*:*:*:*:*:*16.8.0 cert5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert6:*:*:*:*:*:*16.8.0 cert6VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert7:*:*:*:*:*:*16.8.0 cert7VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert8:*:*:*:*:*:*16.8.0 cert8VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert9:*:*:*:*:*:*16.8.0 cert9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*18.9 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*18.9 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*18.9 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*18.9 cert4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*18.9 cert5VulnerableSangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc1:*:*:*:*:*:* Versions 13.13.0 rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc2:*:*:*:*:*:* Versions 13.13.0 rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:-:*:*:*:*:*:* Versions 16.8.0 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert1:*:*:*:*:*:* Versions 16.8.0 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert10:*:*:*:*:*:* Versions 16.8.0 cert10 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert11:*:*:*:*:*:* Versions 16.8.0 cert11 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert12:*:*:*:*:*:* Versions 16.8.0 cert12 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert2:*:*:*:*:*:* Versions 16.8.0 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert3:*:*:*:*:*:* Versions 16.8.0 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert4:*:*:*:*:*:* Versions 16.8.0 cert4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert5:*:*:*:*:*:* Versions 16.8.0 cert5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert6:*:*:*:*:*:* Versions 16.8.0 cert6 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert7:*:*:*:*:*:* Versions 16.8.0 cert7 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert8:*:*:*:*:*:* Versions 16.8.0 cert8 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:16.8.0:cert9:*:*:*:*:*:* Versions 16.8.0 cert9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:* Versions 18.9 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:* Versions 18.9 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:* Versions 18.9 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:* Versions 18.9 cert4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:* Versions 18.9 cert5 Vulnerable ·Sangoma

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37457

References

Patch 1

Advisory 1

Other 1

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
  • TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences