Skip to content
OpenAdvisories
High DLA-4206-1 2 CVEs

asterisk - security update

Published Jun 2, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 asterisk 1:16.28.0~dfsg-0+deb11u7

Vulnerabilities 2

  • High 7.7
    CVE-2025-47779

    Using malformed From header can forge identity with ";" or NULL in name portion

    Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get p…

    asterisk asterisk asterisk asterisk Debian Ubuntu
  • Medium 4.8
    CVE-2025-47780

    cli_permissions.conf: deny option does not work for disallowing shell commands

    Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command li…

    asterisk asterisk asterisk asterisk Debian Ubuntu