Skip to content
OpenAdvisories
Unscored CVE-2021-26712 EUVD-2021-13501GHSA-5ph6-fxv2-7rf2

Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a …

Published Feb 18, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Package: asterisk Package: asterisk Ecosystem: Alpine Ecosystem: Ubuntu

Description

Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 asterisk No fix yet —
Ubuntu 26.04 LTS asterisk No fix yet —
Ubuntu 25.10 asterisk No fix yet —
Ubuntu 24.04 LTS asterisk No fix yet —
Ubuntu 22.04 LTS asterisk No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS asterisk No fix yet —

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 asterisk 18.2.1-r0 —
Alpine v3.23 asterisk 18.2.1-r0 —
Alpine v3.22 asterisk 18.2.1-r0 —
Alpine v3.21 asterisk 18.2.1-r0 —
Alpine v3.20 asterisk 18.2.1-r0 —
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 asterisk 18.2.1-r0 —
Alpine v3.18 asterisk 18.2.1-r0 —
Alpine v3.17 asterisk 18.2.1-r0 —
Alpine v3.16 asterisk 18.2.1-r0 —
Alpine v3.15 asterisk 18.2.1-r0 —
Alpine v3.14 asterisk 18.2.1-r0 —
Alpine v3.13 asterisk 18.2.1-r0 —
Alpine v3.12 asterisk 16.16.1-r0 —

Advisories 1

References