Hi,

The following vulnerability was published for asterisk.

CVE-2026-42225[0]:
| PJSIP is a free and open source multimedia communication library
| written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS
| transport (sip_transport_tls) can accept connections with invalid or
| untrusted certificates even when the application explicitly enables
| certificate verification via verify_server = PJ_TRUE or
| verify_client = PJ_TRUE. This issue has been patched in version
| 2.17.

https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmx
https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4c90e28920 (2.17)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-42225
https://www.cve.org/CVERecord?id=CVE-2026-42225

Please adjust the affected versions in the BTS as needed.

Quoting Moritz Mühlenhoff (2026-05-08 15:13:54)

This was fixed in pjproject 2.17, included since asterisk 22.10.0.

Closing as fixed since Debian packaging release
1:22.10.0+dfsg+~cs6.17.60671434-1.

Thanks,

 - Jonas