{"id":"UBUNTU-CVE-2025-47779","details":"Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.","modified":"2026-05-20T16:23:32.501704340Z","published":"2025-05-22T17:15:00Z","upstream":["CVE-2025-47779"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-47779"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2025-47779"},{"type":"REPORT","url":"https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample"},{"type":"REPORT","url":"https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw"}],"affected":[{"package":{"name":"asterisk","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=esm-apps%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.1.0~dfsg-1.1ubuntu3","1:13.1.0~dfsg-1.1ubuntu4","1:13.1.0~dfsg-1.1ubuntu4.1","1:13.1.0~dfsg-1.1ubuntu4.1+esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-config"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-dahdi"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-mobile"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-modules"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-mp3"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-mysql"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-ooh323"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-voicemail"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-voicemail-imapstorage"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-voicemail-odbcstorage"},{"binary_version":"1:13.1.0~dfsg-1.1ubuntu4.1+esm1","binary_name":"asterisk-vpb"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47779.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.17.2~dfsg-1ubuntu1","1:13.17.2~dfsg-2ubuntu1","1:13.18.1~dfsg-1ubuntu1","1:13.18.3~dfsg-1ubuntu1","1:13.18.3~dfsg-1ubuntu2","1:13.18.3~dfsg-1ubuntu3","1:13.18.3~dfsg-1ubuntu4"],"ecosystem_specific":{"binaries":[{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-config"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-dahdi"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-mobile"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-modules"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-mp3"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-mysql"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-ooh323"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-tests"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-voicemail"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-voicemail-imapstorage"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-voicemail-odbcstorage"},{"binary_version":"1:13.18.3~dfsg-1ubuntu4","binary_name":"asterisk-vpb"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47779.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:16.2.1~dfsg-2build2","1:16.2.1~dfsg-2build3","1:16.2.1~dfsg-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-config"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-dahdi"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-mobile"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-modules"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-mp3"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-mysql"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-ooh323"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-tests"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-voicemail"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-voicemail-imapstorage"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-voicemail-odbcstorage"},{"binary_version":"1:16.2.1~dfsg-2ubuntu1","binary_name":"asterisk-vpb"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47779.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:16.16.1~dfsg-2","1:16.16.1~dfsg-4","1:16.16.1~dfsg-4build1","1:16.16.1~dfsg+~2.10-1","1:18.10.0~dfsg+~cs6.10.40431411-2"],"ecosystem_specific":{"binaries":[{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-config"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-dahdi"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-mobile"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-modules"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-mp3"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-mysql"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-ooh323"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-tests"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-vpb"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47779.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20.4.0~dfsg+~cs6.13.40431414-2","1:20.5.0~dfsg+~cs6.13.40431414-1","1:20.5.1~dfsg+~cs6.13.40431414-1","1:20.5.2~dfsg+~cs6.13.40431414-1","1:20.6.0~dfsg+~cs6.13.40431414-1","1:20.6.0~dfsg+~cs6.13.40431414-2","1:20.6.0~dfsg+~cs6.13.40431414-2build3","1:20.6.0~dfsg+~cs6.13.40431414-2build4","1:20.6.0~dfsg+~cs6.13.40431414-2build5"],"ecosystem_specific":{"binaries":[{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-config"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-dahdi"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-mobile"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-modules"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-mp3"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-mysql"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-ooh323"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-tests"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47779.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:22.2.0~dfsg+~cs6.15.60671435-2","1:22.3.0~dfsg+~cs6.15.60671435-1","1:22.4.1~dfsg+~cs6.15.60671435-1","1:22.4.1~dfsg+~cs6.15.60671435-2","1:22.5.1~dfsg+~cs6.15.60671435-1","1:22.5.2~dfsg+~cs6.15.60671435-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-config"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-dahdi"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mobile"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-modules"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mp3"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mysql"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-ooh323"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-tests"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47779.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:22.5.2~dfsg+~cs6.15.60671435-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-config"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-dahdi"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mobile"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-modules"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mp3"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mysql"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-ooh323"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-tests"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47779.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}]}