cve/2023/CVE-2023-37457.md

### [CVE-2023-37457](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37457)
![](https://img.shields.io/static/v1?label=Product&message=asterisk&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%3D%2018.20.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-120%3A%20Buffer%20Copy%20without%20Checking%20Size%20of%20Input%20('Classic%20Buffer%20Overflow')&color=brighgreen)

### Description

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/DiRaltvein/memory-corruption-examples