CVE-2021-26717 Denial of service in n/a

High 7.5 Published 18 Feb 2021 Updated 3 Aug 2024

A remote attacker can cause a denial of service in Asterisk by delaying T.38 re-negotiation responses, leading to a crash.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-26717?

CVE-2021-26717 is a high-severity denial of service vulnerability in Digium Asterisk, published on 18 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.

Which versions are affected by CVE-2021-26717?

It affects 2 products.

Products include Digium Asterisk, Digium Certified Asterisk.

How do I fix CVE-2021-26717?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-26717 being exploited?

There is no known exploitation of CVE-2021-26717 in the wild and no public exploit code.

All Digium Asterisk vulnerabilities

Sources

Also known as ALPINE-CVE-2021-26717, DEBIAN-CVE-2021-26717, GHSA-9mrj-wq9r-h4vw, UBUNTU-CVE-2021-26717.