Bug#1136007: asterisk: CVE-2026-42225

[Moritz Mühlenhoff]

Source: asterisk
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for asterisk.

CVE-2026-42225[0]:
| PJSIP is a free and open source multimedia communication library
| written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS
| transport (sip_transport_tls) can accept connections with invalid or
| untrusted certificates even when the application explicitly enables
| certificate verification via verify_server = PJ_TRUE or
| verify_client = PJ_TRUE. This issue has been patched in version
| 2.17.

https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmx
https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4c90e28920 (2.17)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-42225
    https://www.cve.org/CVERecord?id=CVE-2026-42225

Please adjust the affected versions in the BTS as needed.