[From nobody Fri Jun 26 22:15:05 2026 Received: (at 1136007-done) by bugs.debian.org; 26 Jun 2026 21:12:08 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-16.9 required=4.0 tests=BAYES_00,FOURLA, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,SPF_HELO_PASS,SPF_PASS, VERSION,X_DEBBUGS_CC autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 30; hammy, 150; neutral, 104; spammy, 0. spammytokens: hammytokens:0.000-+--H*ct:application, 0.000-+--H*ct:protocol, 0.000-+--H*ct:micalg, 0.000-+--H*ct:signed, 0.000-+--H*ct:pgp-signature Return-path: <dr@jones.dk> Received: from graograman.jones.dk ([87.104.249.100]:41278 helo=xayide.jones.dk) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <dr@jones.dk>) id 1wdDqH-00AkE9-1S for 1136007-done@bugs.debian.org; Fri, 26 Jun 2026 21:12:08 +0000 Received: from localhost (localhost [127.0.0.1]) by xayide.jones.dk (Postfix) with ESMTP id 1A618309A for <1136007-done@bugs.debian.org>; Fri, 26 Jun 2026 23:12:01 +0200 (CEST) Received: from xayide.jones.dk ([127.0.0.1]) by localhost (xayide.jones.dk [127.0.0.1]) (amavis, port 10024) with LMTP id DE9g8woCtxoQ for <1136007-done@bugs.debian.org>; Fri, 26 Jun 2026 23:11:59 +0200 (CEST) Received: from localhost (unknown [192.168.222.33]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by xayide.jones.dk (Postfix) with ESMTPSA id 859C51D6D for <1136007-done@bugs.debian.org>; Fri, 26 Jun 2026 23:11:59 +0200 (CEST) Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="===============1755941322844244914==" MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <af3hkoUbHVV2IoIi@pisco.westfalen.local> References: <af3hkoUbHVV2IoIi@pisco.westfalen.local> Subject: Re: Bug#1136007: asterisk: CVE-2026-42225 From: Jonas Smedegaard <jonas@jones.dk> X-Debbugs-Cc: Moritz =?utf-8?q?M=C3=BChlenhoff?= <jmm@inutil.org> To: 1136007-done@bugs.debian.org Reply-To: 1136007@bugs.debian.org Date: Fri, 26 Jun 2026 23:11:59 +0200 Message-ID: <178250831913.2845312.10369363490207159583@cairon.jones.dk> User-Agent: alot/0.12 --===============1755941322844244914== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Version: 1:22.10.0+dfsg+~cs6.17.60671434-1 Quoting Moritz M=C3=BChlenhoff (2026-05-08 15:13:54) > Source: asterisk > X-Debbugs-CC: team@security.debian.org > Severity: grave > Tags: security >=20 > Hi, >=20 > The following vulnerability was published for asterisk. >=20 > CVE-2026-42225[0]: > | PJSIP is a free and open source multimedia communication library > | written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS > | transport (sip_transport_tls) can accept connections with invalid or > | untrusted certificates even when the application explicitly enables > | certificate verification via verify_server =3D PJ_TRUE or > | verify_client =3D PJ_TRUE. This issue has been patched in version > | 2.17. >=20 > https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmx > https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4= c90e28920 (2.17) >=20 >=20 > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. >=20 > For further information see: >=20 > [0] https://security-tracker.debian.org/tracker/CVE-2026-42225 > https://www.cve.org/CVERecord?id=3DCVE-2026-42225 >=20 > Please adjust the affected versions in the BTS as needed. This was fixed in pjproject 2.17, included since asterisk 22.10.0. Closing as fixed since Debian packaging release 1:22.10.0+dfsg+~cs6.17.60671434-1. Thanks, - Jonas --=20 * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ * Sponsorship: https://ko-fi.com/drjones [x] quote me freely [ ] ask before reusing [ ] keep private --===============1755941322844244914== MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Description: signature Content-Type: application/pgp-signature; name="signature.asc"; charset="us-ascii" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAmo+6xsACgkQLHwxRsGg ASH5IA/7BVdAJoqM/I9RVhL332Zu1gcvkk2tphGn239W0paBYbRq8exWrtwJdB+g 2mfIGnqGsr05XtIL+NYtf27LOXfUPhq7P4a0NMwZQ6Xajdi8PQwQmoASiNC9LblY FL3z1l2aBtVccc18660Czj231aUZaW8t0Y7aWZIhJIO3oOGJ2jDSl1X104osR+gE mLfHyVvTqyNcAnR0hhlHcpMf/2Bj9qoOxUgSQwSvRRzOIrcG4e35BYC9u0ui9Q3d Fz1HTZovJfJkOefs4H3zWvBzj3/OlpNmKYQmO0ZtGG1Tp93i1e+sRMX1mEkOaP0T 3hyYdlKQe+bg9ET97Q3fSuII/X6/JHO4zPFjXglfGWdsr31Ge3jbsAMyEhq+cTaQ jCH2pHR3rkJbiY/xaapzvK3uHJqBEqEpwKhxDwV7I3gHW/Koox2fGJfZ8agMMxuz k5lMTaAC4w7hXRYBdVUKIJocTBYLOh/dz9FhY3PxufaWPjie8+8wrlHIv+aB+mB/ tTtQr253N701etcKbFOpDe+QUp720o5pyfB7XWDTMrDjFLg/dtpIJd2rxG3bhT7u x7DyUvdT+JvykzvKQ90aKb49curTTkp48otW1Orc3qsgUfvat8/bzGHl7TmlEM4G Kt/3OpZ7kjhuiUUbox/JlaJowy7r7+VUYRkMufOIZDRnXLhFfzo= =sME7 -----END PGP SIGNATURE----- --===============1755941322844244914==-- ]