PT-2021-17111 · Sangoma+1 · Asterisk+1

Gmza + 1 · Published 2021-02-18 · Updated 2025-02-13 · CVE-2021-26717

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Sangoma Asterisk versions 16.x through 16.16.0 Sangoma Asterisk versions 17.x through 17.9.1 Sangoma Asterisk versions 18.x through 18.2.0 Certified Asterisk versions prior to 16.8-cert6

Description An issue was discovered in Sangoma Asterisk. When re-negotiating for T.38, if the initial remote response was delayed, Asterisk would send both audio and T.38 in the SDP. If this happened and the remote responded with a declined T.38 stream, then Asterisk would crash.

Recommendations For Sangoma Asterisk versions 16.x through 16.16.0, update to version 16.16.1 or later. For Sangoma Asterisk versions 17.x through 17.9.1, update to version 17.9.2 or later. For Sangoma Asterisk versions 18.x through 18.2.0, update to version 18.2.1 or later. For Certified Asterisk versions prior to 16.8-cert6, update to version 16.8-cert6 or later.

Fix

Related Identifiers

ALT-PU-2023-6874

ALT-PU-2025-2613

CVE-2021-26717

Affected Products

Alt Linux

Asterisk

References · 15

• https://issues.asterisk.org/jira/browse/ASTERISK-29203 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26717 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-26717 · Vendor Advisory
• https://downloads.asterisk.org/pub/security · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-26717 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-26717 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26717 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-26717 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26717 · Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2021-002.html · Vendor Advisory
• http://seclists.org/fulldisclosure/2021/Feb/58 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-26717 · Security Note
• https://security.alpinelinux.org/vuln/CVE-2021-26717 · Note
• https://t.me/cibsecurity/23833 · Telegram Post
• http://packetstormsecurity.com/files/161471/Asterisk-Project-Security-Advisory-AST-2021-002.html · Note