{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Certified Asterisk Security",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asterisk Development Team via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Asterisk Development Team would like to announce security release  \nCertified Asterisk 20.7-cert9.\n\nThe release artifacts are available for immediate download at  \nhttps://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert9\nand\nhttps://downloads.asterisk.org/pub/telephony/certified-asterisk\n\nRepository: https://github.com/asterisk/asterisk\nTag: certified-20.7-cert9\n\n\n## Change Log for Release asterisk-certified-20.7-cert9\n\n### Links:\n\n - [Full \nChangeLog](https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-20.7-cert9.html)\n  \n - [GitHub Diff](https://github.com/asterisk/asterisk/compare/certified-20.7-cert8...certified-20.7-cert9)  \n - [Tarball](https://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-20.7-cert9.tar.gz)  \n - [Downloads](https://downloads.asterisk.org/pub/telephony/certified-asterisk)  \n\n### Summary:\n\n- Commits: 4\n- Commit Authors: 2\n- Issues Resolved: 0\n- Security Advisories Resolved: 4\n  - [GHSA-85x7-54wr-vh42](https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42): Asterisk xml.c \nuses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - [GHSA-rvch-3jmx-3jf3](https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3): ast_coredumper \nrunning as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation\n  - [GHSA-v6hp-wh3r-cwxh](https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh): The Asterisk \nembedded web server\u0027s /httpstatus page echos user supplied values(cookie and query string) without sanitization\n  - [GHSA-xpc6-x892-v83c](https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c): ast_coredumper \nruns as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation \n\n### User Notes:\n\n- #### ast_coredumper: check ast_debug_tools.conf permissions\n  ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n\n### Upgrade Notes:\n\n- #### http.c: Change httpstatus to default disabled and sanitize output.\n  To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n\n### Developer Notes:\n\n\n### Commit Authors:\n\n- George Joseph: (2)\n- Mike Bradeen: (2)\n\n## Issue and Commit Detail:\n\n### Closed Issues:\n\n  - !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection\n  - !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially \nleading to privilege escalation\n  - !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server\u0027s /httpstatus page echos user supplied values(cookie and \nquery string) without sanitization\n  - !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to \npotential privilege escalation \n\n### Commits By Author:\n\n- #### George Joseph (2):\n\n- #### Mike Bradeen (2):\n\n### Commit List:\n\n-  xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n-  ast_coredumper: check ast_debug_tools.conf permissions\n-  http.c: Change httpstatus to default disabled and sanitize output.\n-  ast_coredumper: create gdbinit file with restrictive permissions\n\n### Commit Details:\n\n#### xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external\n  entities, could allow a potential XXE injection attack.  Replacing it with\n  XML_PARSE_NONET, which prevents network access, is safer.\n\n  Resolves: #GHSA-85x7-54wr-vh42\n\n#### ast_coredumper: check ast_debug_tools.conf permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Prevent ast_coredumper from using ast_debug_tools.conf files that are\n  not owned by root or are writable by other users or groups.\n\n  Prevent ast_logescalator and ast_loggrabber from doing the same if\n  they are run as root.\n\n  Resolves: #GHSA-rvch-3jmx-3jf3\n\n  UserNote: ast_debug_tools.conf must be owned by root and not be\n  writable by other users or groups to be used by ast_coredumper or\n  by ast_logescalator or ast_loggrabber when run as root.\n\n#### http.c: Change httpstatus to default disabled and sanitize output.\n  Author: George Joseph\n  Date:   2026-01-15\n\n  To address potential security issues, the httpstatus page is now disabled\n  by default and the echoed query string and cookie output is html-escaped.\n\n  Resolves: #GHSA-v6hp-wh3r-cwxh\n\n  UpgradeNote: To prevent possible security issues, the `/httpstatus` page\n  served by the internal web server is now disabled by default.  To explicitly\n  enable it, set `enable_status=yes` in http.conf.\n\n#### ast_coredumper: create gdbinit file with restrictive permissions\n  Author: Mike Bradeen\n  Date:   2026-01-15\n\n  Modify gdbinit to use the install command with explicit permissions (-m 600)\n  when creating the .ast_coredumper.gdbinit file. This ensures the file is\n  created with restricted permissions (readable/writable only by the owner)\n  to avoid potential privilege escalation.\n\n  Resolves: #GHSA-xpc6-x892-v83c\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/5"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk/asterisk-certified-20.7-cert9.tar.gz"
        },
        {
          "url": "https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-20.7-cert9.html"
        },
        {
          "url": "https://github.com/asterisk/asterisk"
        },
        {
          "url": "https://github.com/asterisk/asterisk/compare/certified-20.7-cert8...certified-20.7-cert9"
        },
        {
          "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert9"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh"
        },
        {
          "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Certified Asterisk Security Release certified-20.7-cert9",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0205",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/5",
            "automated": true,
            "contentSha256": "47cc89db2f736f21c4fc8e71de5d98b1336a66cd540cedb7c6c3ae137abfcc30",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-05T16:45:57Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0205"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}