[rpms/asterisk] f45: Fix for CVE-2026-84975

[rpms/asterisk] f45: Fix for CVE-2026-84975

[Peter Lemenkov]

            A new commit has been pushed.

            Repo   : rpms/asterisk
            Branch : f45
            Commit : 32470577e51386fd5b9de9b504f2ff92f5051c0d
            Author : Peter Lemenkov <lemenkov@gmail.com>
            Date   : 2026-09-23T16:38:25+02:00
            Stats  : +83/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/asterisk/c/32470577e51386fd5b9de9b504f2ff92f5051c0d?branch=f45

            Log:
            Fix for CVE-2026-84975

Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>

---
diff --git a/0032-Merge-commit-from-fork.patch b/0032-Merge-commit-from-fork.patch
new file mode 100644
index 0000000..89be806
--- /dev/null
+++ b/0032-Merge-commit-from-fork.patch
@@ -0,0 +1,77 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: sauwming <ming@teluu.com>
+Date: Fri, 17 Jul 2026 16:46:33 +0800
+Subject: [PATCH] Merge commit from fork
+
+SubjectAltName entries from the OpenSSL and GnuTLS backends were copied
+with pj_strdup2(), which re-derives the length with strlen() and thus
+discards the length already returned by ASN1_STRING_to_UTF8() /
+gnutls_x509_crt_get_subject_alt_name(). A DNS SAN such as
+"victim.example\0.attacker" was therefore truncated to "victim.example".
+
+sip_transport_tls.c disables socket-layer verification and performs its
+own length-aware identity match against subj_alt_name, so the truncated
+prefix compared equal to the target host and a crafted certificate was
+accepted for the prefix hostname (server identity / hostname verification
+bypass; OpenSSL's own X509_check_host() rejects the same certificate).
+
+Copy the SAN using its explicit length via pj_strset()/pj_strdup_with_null()
+so embedded NULs are preserved and no longer truncated. The mbedTLS backend
+already copied with a length-bearing pj_str_t and was not affected.
+
+Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
+
+diff --git a/pjlib/src/pj/ssl_sock_gtls.c b/pjlib/src/pj/ssl_sock_gtls.c
+index de3d5e99e..1aa9728dc 100644
+--- a/pjlib/src/pj/ssl_sock_gtls.c
++++ b/pjlib/src/pj/ssl_sock_gtls.c
+@@ -1062,9 +1062,22 @@ static void tls_cert_get_info(pj_pool_t *pool, pj_ssl_cert_info *ci,
+ 
+             if (len && type != PJ_SSL_CERT_NAME_UNKNOWN) {
+                 ci->subj_alt_name.entry[ci->subj_alt_name.cnt].type = type;
+-                pj_strdup2(pool,
++                if (type == PJ_SSL_CERT_NAME_IP) {
++                    pj_strdup2(pool,
+                         &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
+-                        type == PJ_SSL_CERT_NAME_IP ? buf : out);
++                        buf);
++                } else {
++                    /* Preserve the reported length instead of using strlen(),
++                     * so a DNS SAN containing an embedded NUL is not truncated
++                     * at the NUL (which would allow a crafted cert to be
++                     * accepted for the prefix hostname; identity bypass).
++                     */
++                    pj_str_t tmp;
++                    pj_strset(&tmp, out, len);
++                    pj_strdup_with_null(pool,
++                        &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
++                        &tmp);
++                }
+                 ci->subj_alt_name.cnt++;
+             }
+         }
+diff --git a/pjlib/src/pj/ssl_sock_ossl.c b/pjlib/src/pj/ssl_sock_ossl.c
+index 93fcf10f1..492417b47 100644
+--- a/pjlib/src/pj/ssl_sock_ossl.c
++++ b/pjlib/src/pj/ssl_sock_ossl.c
+@@ -2280,9 +2280,17 @@ static void get_cert_info(pj_pool_t *pool, pj_ssl_cert_info *ci, X509 *x,
+                           &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
+                           buf);
+                 } else {
+-                    pj_strdup2(pool, 
+-                          &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name, 
+-                          (char*)p);
++                    /* Preserve the explicit ASN.1 string length instead of
++                     * treating the data as a NUL-terminated C string. A DNS
++                     * SAN such as "host.example\0.attacker" would otherwise be
++                     * truncated at the embedded NUL, letting a crafted cert be
++                     * accepted for the prefix hostname (identity bypass).
++                     */
++                    pj_str_t tmp;
++                    pj_strset(&tmp, (char*)p, len);
++                    pj_strdup_with_null(pool,
++                          &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
++                          &tmp);
+                     OPENSSL_free(p);
+                 }
+                 ci->subj_alt_name.cnt++;

diff --git a/asterisk.spec b/asterisk.spec
index 309b146..4c5e389 100644
--- a/asterisk.spec
+++ b/asterisk.spec
@@ -57,7 +57,7 @@
 Summary:          The Open Source PBX
 Name:             asterisk
 Version:          23.5.0
-Release:          %{?_rc||?_beta:0.}4%{?_rc:.rc%{_rc}}%{?_beta:.beta%{_beta}}%{?dist}.1
+Release:          %{?_rc||?_beta:0.}5%{?_rc:.rc%{_rc}}%{?_beta:.beta%{_beta}}%{?dist}
 # Automatically converted from old format: GPLv2 - review is highly recommended.
 License:          GPL-2.0-only
 URL:              http://www.asterisk.org/
@@ -94,6 +94,7 @@ Source10:         https://github.com/benmcollins/libjwt/releases/download/v%{jwt
 
 Source99:         0030-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility-5036.patch
 Source100:        0031-Merge-commit-from-fork.patch
+Source101:        0032-Merge-commit-from-fork.patch
 
 %if 0%{?fedora} || 0%{?rhel} >=7
 Patch1:           asterisk-16.1.0-explicit-python3.patch
@@ -651,6 +652,7 @@ echo '*************************************************************************'
 
 cp %{S:99} ./third-party/pjproject/patches
 cp %{S:100} ./third-party/pjproject/patches
+cp %{S:101} ./third-party/pjproject/patches
 
 # Fixup makefile so sound archives aren't downloaded/installed
 %{__perl} -pi -e 's/^all:.*$/all:/' sounds/Makefile
@@ -1644,6 +1646,9 @@ fi
 %endif
 
 %changelog
+* Wed Sep 23 2026 Peter Lemenkov <lemenkov@gmail.com> - 23.5.0-5
+- Fix for CVE-2026-84975
+
 * Sun Sep 13 2026 Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com> - 23.5.0-4.1
 - Rebuilt for libxml-2.15.4 (again)