CVE-2023-37457

Summary

CVE-2023-37457 affects versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0 of Asterisk, an open-source telephony software. The vulnerability lies in the 'update' functionality of the PJSIP_HEADER dialplan function, which can exceed the buffer space for new header values. This may result in memory overwrite or a crash. The issue is not exploitable externally, but could be if the dialplan is written to update a header based on external data. The vulnerability does not occur if 'update' functionality is not used. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.