Skip to content
OpenAdvisories
Unscored CVE-2021-26717 EUVD-2021-13505GHSA-9mrj-wq9r-h4vw

An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 1…

Published Feb 18, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Package: asterisk Package: asterisk Package: asterisk Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 asterisk 1:16.16.1~dfsg-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 asterisk No fix yet —
Ubuntu 26.04 LTS asterisk No fix yet —
Ubuntu 25.10 asterisk No fix yet —
Ubuntu 24.04 LTS asterisk No fix yet —
Ubuntu 22.04 LTS asterisk No fix yet —

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 asterisk 18.2.1-r0 —
Alpine v3.23 asterisk 18.2.1-r0 —
Alpine v3.22 asterisk 18.2.1-r0 —
Alpine v3.21 asterisk 18.2.1-r0 —
Alpine v3.20 asterisk 18.2.1-r0 —
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 asterisk 18.2.1-r0 —
Alpine v3.18 asterisk 18.2.1-r0 —
Alpine v3.17 asterisk 18.2.1-r0 —
Alpine v3.16 asterisk 18.2.1-r0 —
Alpine v3.15 asterisk 18.2.1-r0 —
Alpine v3.14 asterisk 18.2.1-r0 —
Alpine v3.13 asterisk 18.2.1-r0 —
Alpine v3.12 asterisk 16.16.1-r0 —

Advisories 1

References