CVE-2021-26906: Medium severity asterisk vulnerability
An issue was discovered in respjsipsession.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-26906.
What is the severity of CVE-2021-26906?
The severity of CVE-2021-26906 is medium with a score of 5.9.
Which software versions are affected by CVE-2021-26906?
Digium Asterisk versions through 13.38.1, 14.x through 16.16.0, 17.x through 17.9.1, and 18.x through 18.2.0, as well as Certified Asterisk through 16.8-cert5 are affected by CVE-2021-26906.
How can a remote server potentially crash Asterisk due to CVE-2021-26906?
An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk.
Is there a fix available for CVE-2021-26906?
Yes, please refer to the official Asterisk project security advisory AST-2021-005 and download the necessary patches or updates from the Asterisk downloads page.