CVE-2026-57190
Severity not reportedAsterisk is an open source private branch exchange and telephony toolkit.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is set in the CEL `eventtype` column by the `CELGenUserEvent` dialplan application. The `cel_pgsql` or `cel_tds` backend must be loaded and configured, and the administrator must call `CELGenUserEvent` in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/asterisk/asterisk/commit/046a8b0b50623d80926c1adc2eca1c9c17e258ed security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/0a86e45e8cde7630276f8363de45f71d1635d2f4 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/88c65757b56c716b5a175f35941be22e038b256f security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/8bf7746d01221d6d2bcfcd46ba7a1cff066a1a8b security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/8cb6dfd41debb2259ec3a33ccfa78f1d902e4c22 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/a04bee3992c28e1681457370e46f30494b7c6619 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/ff21d90e61d199db9b963c671d125a1e917d41ac security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/20.20.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/21.12.3 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/22.10.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/23.4.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 security-advisories@github.com
- https://github.com/asterisk/asterisk/security/advisories/GHSA-ph27-3m5q-mj5m security-advisories@github.com
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1 security-advisories@github.com