UBUNTU-CVE-2026-57193: Medium severity ubuntu/asterisk vulnerability
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver resconfigldap may permit LDAP filter injection through a SIP username, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The resconfigldap module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 20.7-cert11 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Asterisk deployments with the res_config_ldap module loaded and configured to access an LDAP server are exposed. This LDAP realtime-driver configuration is not enabled by default.
What does an attacker need to exploit it?
An unauthenticated attacker needs to send carefully crafted SIP packets containing a malicious SIP username to an affected deployment. Successful exploitation permits arbitrary LDAP queries and may disclose information.
What can be done if upgrading is not immediately possible?
Disable or unload res_config_ldap, or remove its LDAP server configuration, if LDAP realtime functionality is not required. This removes the prerequisite configuration for the issue.
Which releases contain fixes?
Fixed releases are Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, plus Certified Asterisk 20.7-cert11 and 22.8-cert3.