CVE-2026-116789

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

Copy to clipboard

  <vuln vid="FIXME (make newentry)">
    <topic>freeswitch -- FIXME</topic>
    <affects>
      <package>
	<name>freeswitch</name>
	<range><lt>1.11.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-116789: FreeSWITCH is a Software Defined Telecom Stack
	  enabling the digital transformation from proprietary telecom
	  switches to a software implementation that runs on any commodity
	  hardware. Prior to 1.11.2, dtls_state_setup() compared a peer
	  certificate with the SDP a=fingerprint only when FreeSWITCH was the
	  DTLS client, not when it held the DTLS server role. An
	  unauthenticated peer able to reach the negotiated media port could
	  complete the DTLS-SRTP handshake with an unrelated certificate,
	  obtain the leg's SRTP keys, decrypt and inject media, and displace
	  the legitimate endpoint; on ICE-enabled legs the peer also needs
	  the connectivity-check credentials from SDP, which generally
	  requires signaling visibility or a position on its path. WebRTC and
	  SIP DTLS-SRTP legs are affected whenever the peer selects the
	  active role, while FreeSWITCH client-role handshakes already
	  perform fingerprint validation. Version 1.11.2 introduces the
	  remediation, which requires
	  rtp_dtls_client_cert_verify_mode=fingerprint.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-116789</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-116789</url>
    </references>
    <dates>
      <discovery>2026-11-05</discovery>
      <entry>2026-11-05</entry>
    </dates>
  </vuln>