CVE-2021-26906 — Improper Resource Shutdown or Release in Asterisk

CWE-404 — Improper Resource Shutdown or Release4 documents4 sources
Severity
5.9MEDIUMNVD
EPSS
0.8%
top 25.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Digium AsteriskDebian AsteriskDigium Certified Asterisk
Timeline
PublishedFeb 18
Latest updateMay 24

Description

An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages4 packages

▶NVDdigium/asterisk13.0.0 — 13.38.2+3
▶Debiandigium/asterisk< 1:16.16.1~dfsg-1
▶debiandebian/asterisk< asterisk 1:16.16.1~dfsg-1 (bullseye)

Patches

Patch: seclists.org ↗Patch: issues.asterisk.org ↗Patch: seclists.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-rjqf-qvfr-v23c: An issue was discovered in res_pjsip_session↗2022-05-24
▶
OSV
CVE-2021-26906: An issue was discovered in res_pjsip_session↗2021-02-18
▶

📋Vendor Advisories

1
Debian
CVE-2021-26906: asterisk - An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38....↗2021
▶
CVE-2021-26906 — Improper Resource Shutdown or Release | cvebase