Vulnerability Description
An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Digium | Asterisk | >= 13.0.0, < 13.38.2 |
| Digium | Certified Asterisk | 16.8 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/161477/Asterisk-Project-Security-Advisory-AThird Party Advisory
- http://seclists.org/fulldisclosure/2021/Feb/61Mailing ListPatchThird Party Advisory
- https://downloads.asterisk.org/pub/security/Vendor Advisory
- https://downloads.asterisk.org/pub/security/AST-2021-005.htmlVendor Advisory
- https://issues.asterisk.org/jira/browse/ASTERISK-29196Issue TrackingPatchVendor Advisory
- http://packetstormsecurity.com/files/161477/Asterisk-Project-Security-Advisory-AThird Party Advisory
- http://seclists.org/fulldisclosure/2021/Feb/61Mailing ListPatchThird Party Advisory
- https://downloads.asterisk.org/pub/security/Vendor Advisory
- https://downloads.asterisk.org/pub/security/AST-2021-005.htmlVendor Advisory
- https://issues.asterisk.org/jira/browse/ASTERISK-29196Issue TrackingPatchVendor Advisory
FAQ
What is CVE-2021-26906?
CVE-2021-26906 is a vulnerability with a CVSS score of 5.9 (MEDIUM). An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16...
How severe is CVE-2021-26906?
CVE-2021-26906 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-26906?
Check the references section above for vendor advisories and patch information. Affected products include: Digium Asterisk, Digium Certified Asterisk.