{"answers":{"affected":"It affects 2 products.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47779 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2025-47779 is a high-severity vulnerability in asterisk, published on 22 May 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-47779 and fix it if it is affected.\n\nWhat it is: CVE-2025-47779 is a high-severity vulnerability in asterisk, published on 22 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47779 exists.\n\nAffected product: asterisk. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-47779/ (Markdown: https://insights.sbomify.com/CVE-2025-47779/index.md)","id":"CVE-2025-47779","markdown":"https://insights.sbomify.com/CVE-2025-47779/index.md","name":"CVE-2025-47779","record":{"aliases":["DEBIAN-CVE-2025-47779","GHSA-2grh-7mhv-fcfw","UBUNTU-CVE-2025-47779"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["security_bypass","other"],"network_reachable":"yes","non_default_config":false,"product_category":"Asterisk PBX","requires_auth":"low_privilege","summary":"Authenticated attackers can spoof user identities in SIP MESSAGE requests to send spam and facilitate social engineering attacks.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"asterisk","vendor":"sangoma"},{"product":"certified_asterisk","vendor":"sangoma"}],"cvss":{"score":7.7,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-792","name":"Incomplete Filtering of One or More Instances of Special Elements"},{"id":"CWE-140","name":"Improper Neutralization of Delimiters"}],"description":"Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Using malformed From header can forge identity with \";\" or NULL in name portion","id":"CVE-2025-47779","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"other","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"cli_permissions.conf: deny option does not work for disallowing shell commands","id":"CVE-2025-47780"},"packages":[],"prev":{"headline":"Sulu vulnerable to XXE in SVG File upload Inspector","id":"CVE-2025-47778"},"products":["asterisk"],"published":"2025-05-22","related":[{"cvss_score":9.8,"headline":"Path traversal in n/a","id":"CVE-2024-57520","kev_date_added":null,"published":"2025-02-05"},{"cvss_score":7.5,"headline":"Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request","id":"CVE-2025-57767","kev_date_added":null,"published":"2025-08-28"},{"cvss_score":7.5,"headline":"Memory corruption in n/a","id":"CVE-2022-37325","kev_date_added":null,"published":"2022-12-05"},{"cvss_score":7,"headline":"Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation","id":"CVE-2025-1131","kev_date_added":null,"published":"2025-09-23"},{"cvss_score":6.5,"headline":"Asterisk remotely exploitable leak of RTP UDP ports and internal resources","id":"CVE-2025-54995","kev_date_added":null,"published":"2025-08-28"},{"cvss_score":6.5,"headline":"Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation","id":"CVE-2025-49832","kev_date_added":null,"published":"2025-08-01"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-11-03","vendors":["asterisk"]},"summary":"Authenticated attackers can spoof user identities in SIP MESSAGE requests to send spam and facilitate social engineering attacks.","url":"https://insights.sbomify.com/CVE-2025-47779/"}