CVE-2026-57193

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57193", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T02:00:46.800Z", "datePublished": "2026-10-26T19:46:01.924Z", "dateUpdated": "2026-10-31T01:46:55.030Z"}, "containers": {"cna": {"title": "Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)", "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "lang": "en", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp"}, {"name": "https://github.com/asterisk/asterisk/commit/04aa482212e43b292817444eb4de35499f4b1568", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/04aa482212e43b292817444eb4de35499f4b1568"}, {"name": "https://github.com/asterisk/asterisk/commit/14968f2f440ea0dd983caa4f477237a5224904dd", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/14968f2f440ea0dd983caa4f477237a5224904dd"}, {"name": "https://github.com/asterisk/asterisk/commit/23c01b6d359c5d85da725beea89e394a6c031c5d", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/23c01b6d359c5d85da725beea89e394a6c031c5d"}, {"name": "https://github.com/asterisk/asterisk/commit/7e1ae09594a101950398cc6aff2dd2e5ab314884", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/7e1ae09594a101950398cc6aff2dd2e5ab314884"}, {"name": "https://github.com/asterisk/asterisk/commit/8170a6bfa75994e7617a8b9d7fe7a7140b70cbe2", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/8170a6bfa75994e7617a8b9d7fe7a7140b70cbe2"}, {"name": "https://github.com/asterisk/asterisk/commit/dd0c768d9e9678e4cb1ed95689a254a61452239b", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/dd0c768d9e9678e4cb1ed95689a254a61452239b"}, {"name": "https://github.com/asterisk/asterisk/commit/ef280572a034cac3994075298facb1999778ee0d", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/ef280572a034cac3994075298facb1999778ee0d"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"name": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "affected": [{"vendor": "asterisk", "product": "asterisk", "versions": [{"version": "< 20.20.1", "status": "affected"}, {"version": ">= 21.0.0-pre1, < 21.12.3", "status": "affected"}, {"version": ">= 22.0.0-pre1, < 22.10.1", "status": "affected"}, {"version": ">= 23.0.0-pre1, < 23.4.1", "status": "affected"}]}, {"vendor": "asterisk", "product": "certified-asterisk", "versions": [{"version": "< 20.7-cert11", "status": "affected"}, {"version": ">= 22.8-cert1-pre1, < 22.8-cert3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-26T19:46:01.924Z"}, "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "source": {"advisory": "GHSA-r6c2-hwc2-j4mp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-31T01:46:45.323083Z", "id": "CVE-2026-57193", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-31T01:46:55.030Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57193", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T02:00:46.800Z", "datePublished": "2026-10-26T19:46:01.924Z", "dateUpdated": "2026-10-31T01:46:55.030Z"}, "containers": {"cna": {"title": "Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)", "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "lang": "en", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp"}, {"name": "https://github.com/asterisk/asterisk/commit/04aa482212e43b292817444eb4de35499f4b1568", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/04aa482212e43b292817444eb4de35499f4b1568"}, {"name": "https://github.com/asterisk/asterisk/commit/14968f2f440ea0dd983caa4f477237a5224904dd", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/14968f2f440ea0dd983caa4f477237a5224904dd"}, {"name": "https://github.com/asterisk/asterisk/commit/23c01b6d359c5d85da725beea89e394a6c031c5d", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/23c01b6d359c5d85da725beea89e394a6c031c5d"}, {"name": "https://github.com/asterisk/asterisk/commit/7e1ae09594a101950398cc6aff2dd2e5ab314884", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/7e1ae09594a101950398cc6aff2dd2e5ab314884"}, {"name": "https://github.com/asterisk/asterisk/commit/8170a6bfa75994e7617a8b9d7fe7a7140b70cbe2", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/8170a6bfa75994e7617a8b9d7fe7a7140b70cbe2"}, {"name": "https://github.com/asterisk/asterisk/commit/dd0c768d9e9678e4cb1ed95689a254a61452239b", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/dd0c768d9e9678e4cb1ed95689a254a61452239b"}, {"name": "https://github.com/asterisk/asterisk/commit/ef280572a034cac3994075298facb1999778ee0d", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/ef280572a034cac3994075298facb1999778ee0d"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"name": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "affected": [{"vendor": "asterisk", "product": "asterisk", "versions": [{"version": "< 20.20.1", "status": "affected"}, {"version": ">= 21.0.0-pre1, < 21.12.3", "status": "affected"}, {"version": ">= 22.0.0-pre1, < 22.10.1", "status": "affected"}, {"version": ">= 23.0.0-pre1, < 23.4.1", "status": "affected"}]}, {"vendor": "asterisk", "product": "certified-asterisk", "versions": [{"version": "< 20.7-cert11", "status": "affected"}, {"version": ">= 22.8-cert1-pre1, < 22.8-cert3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-26T19:46:01.924Z"}, "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "source": {"advisory": "GHSA-r6c2-hwc2-j4mp", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57193", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-31T01:46:45.323083Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-31T01:46:50.500Z"}}]}}

{"affected": [{"affectedData": [{"product": "asterisk", "vendor": "asterisk", "versions": [{"status": "affected", "version": "< 20.20.1"}, {"status": "affected", "version": ">= 21.0.0-pre1, < 21.12.3"}, {"status": "affected", "version": ">= 22.0.0-pre1, < 22.10.1"}, {"status": "affected", "version": ">= 23.0.0-pre1, < 23.4.1"}]}, {"product": "certified-asterisk", "vendor": "asterisk", "versions": [{"status": "affected", "version": "< 20.7-cert11"}, {"status": "affected", "version": ">= 22.8-cert1-pre1, < 22.8-cert3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "id": "CVE-2026-57193", "lastModified": "2026-10-31T02:17:34.120", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57193", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-31T01:46:45.323083Z", "version": "2.0.3"}}]}, "published": "2026-10-26T20:17:56.877", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/04aa482212e43b292817444eb4de35499f4b1568"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/14968f2f440ea0dd983caa4f477237a5224904dd"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/23c01b6d359c5d85da725beea89e394a6c031c5d"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/7e1ae09594a101950398cc6aff2dd2e5ab314884"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/8170a6bfa75994e7617a8b9d7fe7a7140b70cbe2"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/dd0c768d9e9678e4cb1ed95689a254a61452239b"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/ef280572a034cac3994075298facb1999778ee0d"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-943"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "asterisk: asterisk: Information disclosure via LDAP filter injection in res_config_ldap", "id": "2561052", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561052"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-90", "details": ["Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.", "A flaw was found in Asterisk's res_config_ldap module. An unauthenticated remote attacker can exploit this flaw to cause information disclosure through Lightweight Directory Access Protocol (LDAP) filter injection. By sending specially crafted Session Initiation Protocol (SIP) packets with a manipulated username, an attacker can execute arbitrary LDAP queries and retrieve sensitive directory data when the module is configured to connect to an LDAP server."], "name": "CVE-2026-57193", "public_date": "2026-10-26T19:46:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-57193\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57193\nhttps://github.com/asterisk/asterisk/commit/04aa482212e43b292817444eb4de35499f4b1568\nhttps://github.com/asterisk/asterisk/commit/14968f2f440ea0dd983caa4f477237a5224904dd\nhttps://github.com/asterisk/asterisk/commit/23c01b6d359c5d85da725beea89e394a6c031c5d\nhttps://github.com/asterisk/asterisk/commit/7e1ae09594a101950398cc6aff2dd2e5ab314884\nhttps://github.com/asterisk/asterisk/commit/8170a6bfa75994e7617a8b9d7fe7a7140b70cbe2\nhttps://github.com/asterisk/asterisk/commit/dd0c768d9e9678e4cb1ed95689a254a61452239b\nhttps://github.com/asterisk/asterisk/commit/ef280572a034cac3994075298facb1999778ee0d\nhttps://github.com/asterisk/asterisk/releases/tag/20.20.1\nhttps://github.com/asterisk/asterisk/releases/tag/21.12.3\nhttps://github.com/asterisk/asterisk/releases/tag/22.10.1\nhttps://github.com/asterisk/asterisk/releases/tag/23.4.1\nhttps://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11\nhttps://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3\nhttps://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp\nhttps://github.com/asterisk/asterisk/tree/24.0.0-pre1"], "statement": "This vulnerability is rated as Moderate impact because, while unauthenticated remote actors can trigger arbitrary queries over SIP, the flaw is strictly confined to unauthorized directory information disclosure and does not grant code execution or service disruption. In typical Red Hat environments, the vulnerable res_config_ldap module is not loaded or configured by default, as directory-backed realtime storage requires explicit administrative setup. Telephony deployments that do not integrate Asterisk with an LDAP backend remain completely unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,20.20.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0-pre1,21.12.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0-pre1,22.10.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0-pre1,23.4.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "asterisk", "source": "cna", "vendor": "asterisk"}, "product": "asterisk", "vendor": "asterisk"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,20.7-cert11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[22.8-cert1-pre1,22.8-cert3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "certified-asterisk", "source": "cna", "vendor": "asterisk"}, "product": "certified_asterisk", "vendor": "asterisk"}], "created": "2026-10-26T23:00:19.658251+00:00", "updated": "2026-11-02T14:45:18.367647+00:00", "vendors": ["asterisk", "asterisk$PRODUCT$asterisk", "asterisk$PRODUCT$certified_asterisk"]}