CVE-2025-57767: Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header with an incorrect realm was received without a previous 401 response being sent, the getauthorizationheader() function in respjsipauthenticatordigest will return a NULL. This wasn't being checked before attempting to get the digest algorithm from the header which causes a SEGV. This issue has been patched in versions 20.15.2, 21.10.2, and 22.5.2. There are no workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57767?
CVE-2025-57767 has been classified with a medium severity rating due to potential authentication bypass vulnerabilities.
How do I fix CVE-2025-57767?
To fix CVE-2025-57767, update Asterisk to version 20.15.2, 21.10.2, or 22.5.2 or later.
Which versions of Asterisk are affected by CVE-2025-57767?
CVE-2025-57767 affects Asterisk versions prior to 20.15.2, 21.10.2, and 22.5.2.
What type of vulnerability is CVE-2025-57767?
CVE-2025-57767 is an authentication bypass vulnerability that can be exploited through manipulated SIP requests.
Can CVE-2025-57767 affect my telephony services?
Yes, CVE-2025-57767 could potentially disrupt your telephony services if exploited, allowing unauthorized access.