CVE-2021-26906

Published: Feb 18, 2021Modified: Nov 21, 2024

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.

Affected (17)

Products: Digium: Asterisk, Certified Asterisk

Digium

2 products

Asterisk

Certified Asterisk

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Digium Asterisk	From 13.0.0 to 13.38.2
Digium Asterisk	From 16.0.0 to 16.16.1
Digium Asterisk	From 17.0.0 to 17.9.2
Digium Asterisk	From 18.0 to 18.2.1
Digium Certified Asterisk	Version 16.8
Digium Certified Asterisk	Version 16.8 cert1-rc1
Digium Certified Asterisk	Version 16.8 cert1-rc2
Digium Certified Asterisk	Version 16.8 cert1-rc3
Digium Certified Asterisk	Version 16.8 cert1-rc4
Digium Certified Asterisk	Version 16.8 cert2
Digium Certified Asterisk	Version 16.8 cert3
Digium Certified Asterisk	Version 16.8 cert4-rc1
Digium Certified Asterisk	Version 16.8 cert4-rc2
Digium Certified Asterisk	Version 16.8 cert4-rc3
Digium Certified Asterisk	Version 16.8 cert4-rc4
Digium Certified Asterisk	Version 16.8 cert4
Digium Certified Asterisk	Version 16.8 cert5