CVE Vulnerabilities

CVE-2021-26717

Published: Feb 18, 2021 | Modified: Feb 24, 2021
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.

Affected Software

Name Vendor Start Version End Version
Asterisk Digium 16.0.0 (including) 16.16.1 (excluding)
Asterisk Digium 17.0.0 (including) 17.9.2 (excluding)
Asterisk Digium 18.0 (including) 18.2.1 (excluding)
Certified_asterisk Digium 16.8 (including) 16.8 (including)
Certified_asterisk Digium 16.8-cert1-rc1 (including) 16.8-cert1-rc1 (including)
Certified_asterisk Digium 16.8-cert1-rc2 (including) 16.8-cert1-rc2 (including)
Certified_asterisk Digium 16.8-cert1-rc3 (including) 16.8-cert1-rc3 (including)
Certified_asterisk Digium 16.8-cert1-rc4 (including) 16.8-cert1-rc4 (including)
Certified_asterisk Digium 16.8-cert2 (including) 16.8-cert2 (including)
Certified_asterisk Digium 16.8-cert3 (including) 16.8-cert3 (including)
Certified_asterisk Digium 16.8-cert4 (including) 16.8-cert4 (including)
Certified_asterisk Digium 16.8-cert4-rc1 (including) 16.8-cert4-rc1 (including)
Certified_asterisk Digium 16.8-cert4-rc2 (including) 16.8-cert4-rc2 (including)
Certified_asterisk Digium 16.8-cert4-rc3 (including) 16.8-cert4-rc3 (including)
Certified_asterisk Digium 16.8-cert4-rc4 (including) 16.8-cert4-rc4 (including)
Certified_asterisk Digium 16.8-cert5 (including) 16.8-cert5 (including)
Asterisk Ubuntu devel *
Asterisk Ubuntu esm-apps/jammy *
Asterisk Ubuntu esm-apps/noble *
Asterisk Ubuntu hirsute *
Asterisk Ubuntu impish *
Asterisk Ubuntu jammy *
Asterisk Ubuntu kinetic *
Asterisk Ubuntu lunar *
Asterisk Ubuntu mantic *
Asterisk Ubuntu noble *
Asterisk Ubuntu trusty *
Asterisk Ubuntu upstream *

References