Source: asterisk X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerability was published for asterisk. CVE-2026-42225[0]: | PJSIP is a free and open source multimedia communication library | written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS | transport (sip_transport_tls) can accept connections with invalid or | untrusted certificates even when the application explicitly enables | certificate verification via verify_server = PJ_TRUE or | verify_client = PJ_TRUE. This issue has been patched in version | 2.17. https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmx https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4c90e28920 (2.17) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-42225 https://www.cve.org/CVERecord?id=CVE-2026-42225 Please adjust the affected versions in the BTS as needed.
