CVE-2023-37457

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
asterisk	asterisk	<= 18.20.0; >= 19.0.0, <= 20.5.0; = 21.0.0; <= 18.9-cert5

References

Timeline

Published: Dec 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-374595.3Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG netwo CVE-2023-37465.4The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and ab CVE-2023-374609.8Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArch CVE-2023-374619.8Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../CVE-2023-374628.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `CVE-2023-374637.5cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Thr CVE-2023-374647.5OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly us CVE-2023-3746610.0vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintena CVE-2023-374675.4Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Secu CVE-2023-374685.5Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored CVE-2023-374698.8CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connec CVE-2023-37475.5Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by