{"schema":"threatline.record/2","record":{"id":"CVE-2026-57193","aliases":["GHSA-r6c2-hwc2-j4mp"],"summary":"Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)","details":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","categories":["Unclassified"],"product":"asterisk","vendor":"asterisk","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57193","source_modified_at":"2026-10-26T19:46:01.924Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"asterisk","vendor":"asterisk","versions":[{"version":"< 20.20.1","status":"affected"},{"version":">= 21.0.0-pre1, < 21.12.3","status":"affected"},{"version":">= 22.0.0-pre1, < 22.10.1","status":"affected"},{"version":">= 23.0.0-pre1, < 23.4.1","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57193","source_modified_at":"2026-10-26T19:46:01.924Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"certified-asterisk","vendor":"asterisk","versions":[{"version":"< 20.7-cert11","status":"affected"},{"version":">= 22.8-cert1-pre1, < 22.8-cert3","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T19:46:01.924Z","modified_at":"2026-10-26T19:46:01.924Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-57193","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T19:46:01.924Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/04aa482212e43b292817444eb4de35499f4b1568","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/14968f2f440ea0dd983caa4f477237a5224904dd","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/23c01b6d359c5d85da725beea89e394a6c031c5d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/7e1ae09594a101950398cc6aff2dd2e5ab314884","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/8170a6bfa75994e7617a8b9d7fe7a7140b70cbe2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/dd0c768d9e9678e4cb1ed95689a254a61452239b","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/ef280572a034cac3994075298facb1999778ee0d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/20.20.1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/21.12.3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/22.10.1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/23.4.1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/tree/24.0.0-pre1","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T19:46:01.924Z","content_hash":"a255985a9291164d0797c5c89d3bfcf0ad9298d0cc84dd65ae5eb9f00cba8d56"}}