high
8.2
CWE
120
Advisory Published
Updated

CVE-2023-37457: Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'

First published: Thu Dec 14 2023(Updated: )

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.

Credit: security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
Asterisk<=18.20.0
Asterisk>=19.0.0<=20.5.0
Asterisk=21.0.0
Asterisk=13.13.0
Asterisk=13.13.0-cert1
Asterisk=13.13.0-cert1-rc1
Asterisk=13.13.0-cert1-rc2
Asterisk=13.13.0-cert1-rc3
Asterisk=13.13.0-cert1-rc4
Asterisk=13.13.0-cert2
Asterisk=13.13.0-cert3
Asterisk=13.13.0-rc1
Asterisk=13.13.0-rc2
Asterisk=16.8.0
Asterisk=16.8.0-cert1
Asterisk=16.8.0-cert10
Asterisk=16.8.0-cert11
Asterisk=16.8.0-cert12
Asterisk=16.8.0-cert2
Asterisk=16.8.0-cert3
Asterisk=16.8.0-cert4
Asterisk=16.8.0-cert5
Asterisk=16.8.0-cert6
Asterisk=16.8.0-cert7
Asterisk=16.8.0-cert8
Asterisk=16.8.0-cert9
Asterisk=18.9-cert1
Asterisk=18.9-cert2
Asterisk=18.9-cert3
Asterisk=18.9-cert4
Asterisk=18.9-cert5

Remedy

https://github.com/asterisk/asterisk/commit/a1ca0268254374b515fa5992f01340f7717113fa

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2023-37457?

    CVE-2023-37457 is considered a moderate severity vulnerability due to the potential for excessive resource consumption.

  • How do I fix CVE-2023-37457?

    To fix CVE-2023-37457, upgrade to Asterisk versions 18.21.0, 20.5.1, 21.0.1, or certified-asterisk 18.9-cert6 or later.

  • What versions of Asterisk are affected by CVE-2023-37457?

    Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0 are affected by CVE-2023-37457.

  • What does CVE-2023-37457 exploit in Asterisk?

    CVE-2023-37457 exploits the 'update' functionality of the PJSIP_HEADER dialplan function, leading to potential resource exhaustion.

  • Is there a workaround for CVE-2023-37457 if I cannot upgrade?

    There are no specific workarounds provided for CVE-2023-37457; upgrading to a fixed version is recommended.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203