CVE-2021-26717 — HIGH (7.5)

Q: How severe is CVE-2021-26717?

CVE-2021-26717 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2021-26717?

Check the references section above for vendor advisories and patch information. Affected products include: Digium Asterisk, Digium Certified Asterisk.

Vulnerability Description

An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Digium	Asterisk	>= 16.0.0, < 16.16.1
Digium	Certified Asterisk	16.8

References

http://packetstormsecurity.com/files/161471/Asterisk-Project-Security-Advisory-AThird Party Advisory
http://seclists.org/fulldisclosure/2021/Feb/58Mailing ListPatchThird Party Advisory
https://downloads.asterisk.org/pub/security/Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2021-002.htmlVendor Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-29203Issue TrackingPatchVendor Advisory
http://packetstormsecurity.com/files/161471/Asterisk-Project-Security-Advisory-AThird Party Advisory
http://seclists.org/fulldisclosure/2021/Feb/58Mailing ListPatchThird Party Advisory
https://downloads.asterisk.org/pub/security/Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2021-002.htmlVendor Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-29203Issue TrackingPatchVendor Advisory

FAQ

What is CVE-2021-26717?

CVE-2021-26717 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remot...

How severe is CVE-2021-26717?

CVE-2021-26717 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-26717?

Check the references section above for vendor advisories and patch information. Affected products include: Digium Asterisk, Digium Certified Asterisk.