UBUNTU-CVE-2026-57196: Low severity ubuntu/asterisk vulnerability

Published Oct 26, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an authorized user's AMI session cookie and impersonate that user when resphoneprov is enabled. The Asterisk HTTP web server, Asterisk Manager Interface (AMI), and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to 127.0.0.1 by default even when enabled, and must convince the authorized user to click a malicious link. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

7 affected components

ubuntu/asterisk*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 26, 2026

CVE Published

via OSV·08:17 PM

Data Sourced

via OSV·08:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Are default Asterisk deployments affected?

Typically no. The Asterisk HTTP web server, AMI, and AMI access via HTTP are all disabled by default. Even when the HTTP server is enabled, it binds to 127.0.0.1 by default, limiting access to the local host.

What conditions are required for exploitation?

The res_phoneprov module must be enabled, along with the Asterisk HTTP server, AMI, and AMI-over-HTTP access. The attacker must be able to reach the HTTP server and persuade an authorized user to open a malicious link.

What is the practical impact of a successful attack?

An attacker can use reflected cross-site scripting in phone-provisioning HTTP error pages to obtain an authorized user's AMI session cookie. The stolen cookie can then be used to impersonate that AMI user.

What can be done before updating?

Disable res_phoneprov if it is not needed, and disable the Asterisk HTTP server, AMI, or AMI access via HTTP where those services are unnecessary. Restrict HTTP server reachability, particularly avoiding exposure beyond localhost or trusted administrative networks.

Which releases contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.