UBUNTU-CVE-2026-57189

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-57189
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-57189.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-57189
Upstream
Published
2026-10-27T17:17:00Z
Modified
2026-10-28T20:17:23Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED out-of-bounds write during generation accumulation using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The chan_sip channel driver must be installed and configured, and its textsupport option must be enabled; textsupport defaults to no. The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions. Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required chan_sip driver was removed there.

References

Affected packages

Ubuntu:18.04:LTS
asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:13.*
1:13.17.2~dfsg-1ubuntu1
1:13.17.2~dfsg-2ubuntu1
1:13.18.1~dfsg-1ubuntu1
1:13.18.3~dfsg-1ubuntu1
1:13.18.3~dfsg-1ubuntu2
1:13.18.3~dfsg-1ubuntu3
1:13.18.3~dfsg-1ubuntu4

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "asterisk",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-config",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-dahdi",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-mobile",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-modules",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-mp3",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-mysql",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-ooh323",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-tests",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-voicemail",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-voicemail-imapstorage",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-voicemail-odbcstorage",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name":  "asterisk-vpb",
            "binary_version":  "1:13.18.3~dfsg-1ubuntu4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-57189.json"
Ubuntu:20.04:LTS
asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:16.*
1:16.2.1~dfsg-2build2
1:16.2.1~dfsg-2build3
1:16.2.1~dfsg-2ubuntu1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "asterisk",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-config",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-dahdi",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-mobile",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-modules",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-mp3",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-mysql",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-ooh323",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-tests",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-voicemail",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-voicemail-imapstorage",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-voicemail-odbcstorage",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name":  "asterisk-vpb",
            "binary_version":  "1:16.2.1~dfsg-2ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-57189.json"
Ubuntu:22.04:LTS
asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:16.*
1:16.16.1~dfsg-2
1:16.16.1~dfsg-4
1:16.16.1~dfsg-4build1
1:16.16.1~dfsg+~2.10-1
1:18.*
1:18.10.0~dfsg+~cs6.10.40431411-2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "asterisk",
            "binary_version":  "1:18.10.0~dfsg+~cs6.10.40431411-2"
        },
        {
            "binary_name":  "asterisk-config",
            "binary_version":  "1:18.10.0~dfsg+~cs6.10.40431411-2"
        },
        {
            "binary_name":  "asterisk-dahdi",
            "binary_version":  "1:18.10.0~dfsg+~cs6.10.40431411-2"
        },
        {
            "binary_name":  "asterisk-mobile",
            "binary_version":  "1:18.10.0~dfsg+~cs6.10.40431411-2"
        },
        {
            "binary_name":  "asterisk-modules",
            "binary_version":  "1:18.10.0~dfsg+~cs6.10.40431411-2"
        },
        {
            "binary_name":  "asterisk-mp3",
            "binary_version":  "1:18.10.0~dfsg+~cs6.10.40431411-2"
        },
        {
            "binary_name":  "asterisk-mysql",
            "binary_version":  "1:18.10.0~dfsg+~cs6.10.40431411-2"
        },
        {
            "binary_name":  "asterisk-ooh323",
            "binary_version":  "1:18.10.0~dfsg+~cs6.10.40431411-2"
        },
        {
            "binary_name":  "asterisk-tests",
            "binary_version":  "1:18.10.0~dfsg+~cs6.10.40431411-2"
        },
        {
            "binary_name":  "asterisk-vpb",
            "binary_version":  "1:18.10.0~dfsg+~cs6.10.40431411-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-57189.json"
Ubuntu:24.04:LTS
asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:20.*
1:20.4.0~dfsg+~cs6.13.40431414-2
1:20.5.0~dfsg+~cs6.13.40431414-1
1:20.5.1~dfsg+~cs6.13.40431414-1
1:20.5.2~dfsg+~cs6.13.40431414-1
1:20.6.0~dfsg+~cs6.13.40431414-1
1:20.6.0~dfsg+~cs6.13.40431414-2
1:20.6.0~dfsg+~cs6.13.40431414-2build3
1:20.6.0~dfsg+~cs6.13.40431414-2build4
1:20.6.0~dfsg+~cs6.13.40431414-2build5

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "asterisk",
            "binary_version":  "1:20.6.0~dfsg+~cs6.13.40431414-2build5"
        },
        {
            "binary_name":  "asterisk-config",
            "binary_version":  "1:20.6.0~dfsg+~cs6.13.40431414-2build5"
        },
        {
            "binary_name":  "asterisk-dahdi",
            "binary_version":  "1:20.6.0~dfsg+~cs6.13.40431414-2build5"
        },
        {
            "binary_name":  "asterisk-mobile",
            "binary_version":  "1:20.6.0~dfsg+~cs6.13.40431414-2build5"
        },
        {
            "binary_name":  "asterisk-modules",
            "binary_version":  "1:20.6.0~dfsg+~cs6.13.40431414-2build5"
        },
        {
            "binary_name":  "asterisk-mp3",
            "binary_version":  "1:20.6.0~dfsg+~cs6.13.40431414-2build5"
        },
        {
            "binary_name":  "asterisk-mysql",
            "binary_version":  "1:20.6.0~dfsg+~cs6.13.40431414-2build5"
        },
        {
            "binary_name":  "asterisk-ooh323",
            "binary_version":  "1:20.6.0~dfsg+~cs6.13.40431414-2build5"
        },
        {
            "binary_name":  "asterisk-tests",
            "binary_version":  "1:20.6.0~dfsg+~cs6.13.40431414-2build5"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-57189.json"
Ubuntu:26.04:LTS
asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:22.*
1:22.5.2~dfsg+~cs6.15.60671435-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "asterisk",
            "binary_version":  "1:22.5.2~dfsg+~cs6.15.60671435-1"
        },
        {
            "binary_name":  "asterisk-config",
            "binary_version":  "1:22.5.2~dfsg+~cs6.15.60671435-1"
        },
        {
            "binary_name":  "asterisk-dahdi",
            "binary_version":  "1:22.5.2~dfsg+~cs6.15.60671435-1"
        },
        {
            "binary_name":  "asterisk-mobile",
            "binary_version":  "1:22.5.2~dfsg+~cs6.15.60671435-1"
        },
        {
            "binary_name":  "asterisk-modules",
            "binary_version":  "1:22.5.2~dfsg+~cs6.15.60671435-1"
        },
        {
            "binary_name":  "asterisk-mp3",
            "binary_version":  "1:22.5.2~dfsg+~cs6.15.60671435-1"
        },
        {
            "binary_name":  "asterisk-mysql",
            "binary_version":  "1:22.5.2~dfsg+~cs6.15.60671435-1"
        },
        {
            "binary_name":  "asterisk-ooh323",
            "binary_version":  "1:22.5.2~dfsg+~cs6.15.60671435-1"
        },
        {
            "binary_name":  "asterisk-tests",
            "binary_version":  "1:22.5.2~dfsg+~cs6.15.60671435-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-57189.json"
Ubuntu:26.10
asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:22.*
1:22.5.2~dfsg+~cs6.15.60671435-1
1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu2
1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "asterisk",
            "binary_version":  "1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3"
        },
        {
            "binary_name":  "asterisk-config",
            "binary_version":  "1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3"
        },
        {
            "binary_name":  "asterisk-dahdi",
            "binary_version":  "1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3"
        },
        {
            "binary_name":  "asterisk-mobile",
            "binary_version":  "1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3"
        },
        {
            "binary_name":  "asterisk-modules",
            "binary_version":  "1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3"
        },
        {
            "binary_name":  "asterisk-mp3",
            "binary_version":  "1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3"
        },
        {
            "binary_name":  "asterisk-mysql",
            "binary_version":  "1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3"
        },
        {
            "binary_name":  "asterisk-ooh323",
            "binary_version":  "1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3"
        },
        {
            "binary_name":  "asterisk-tests",
            "binary_version":  "1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-57189.json"
Ubuntu:Pro:16.04:LTS
asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk?arch=source&distro=esm-apps%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:13.*
1:13.1.0~dfsg-1.1ubuntu3
1:13.1.0~dfsg-1.1ubuntu4
1:13.1.0~dfsg-1.1ubuntu4.1
1:13.1.0~dfsg-1.1ubuntu4.1+esm1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "asterisk",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-config",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-dahdi",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-mobile",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-modules",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-mp3",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-mysql",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-ooh323",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-voicemail",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-voicemail-imapstorage",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-voicemail-odbcstorage",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name":  "asterisk-vpb",
            "binary_version":  "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-57189.json"