Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2021-26717: An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial re...
CVE-2021-26717 · published 5 years ago
Summary
An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happ...
What to do
- Update debian asterisk to version 1:16.16.1~dfsg-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | digium | asterisk |
>= 16.0.0, < 16.16.1 >= 17.0.0, < 17.9.2 >= 18.0, < 18.2.1 cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:* |
| – | digium | certified_asterisk |
16.8 cpe:2.3:a:digium:certified_asterisk:16.8:-:*:*:*:*:*:* |
| Ubuntu:22.04:LTS | canonical | asterisk | All versions |
| Debian:14 | debian | asterisk |
< 1:16.16.1~dfsg-1 Fix: upgrade to 1:16.16.1~dfsg-1
|
Original advisory text
An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial re...
An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.
References
- https://downloads.asterisk.org/pub/security/ Third Party Advisory
- https://downloads.asterisk.org/pub/security/AST-2021-002.html Third Party Advisory
- http://packetstormsecurity.com/files/161471/Asterisk-Project-Security-Advisory-A... Third Party Advisory
- http://seclists.org/fulldisclosure/2021/Feb/58 Third Party Advisory
- https://issues.asterisk.org/jira/browse/ASTERISK-29203 Third Party Advisory
- https://ubuntu.com/security/CVE-2021-26717 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-26717 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-26717 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published18 Feb 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-26717 · NVD
UBUNTU-CVE-2021-26717 · OSV
CVE-2021-26717 · OSV
DEBIAN-CVE-2021-26717 · OSV
Track software like this
Free during beta