CVE-2021-26717: 
NixOS vulnerability analysis and mitigation

A vulnerability (CVE-2021-26717) was discovered in Sangoma Asterisk affecting versions 16.x before 16.16.1, 17.x before 17.9.2, 18.x before 18.2.1, and Certified Asterisk before 16.8-cert6. The issue was discovered on December 8, 2020, and publicly disclosed on February 18, 2021 (Asterisk Advisory).

The vulnerability occurs during T.38 fax protocol negotiation. When re-negotiating for T.38, if the initial remote response was delayed, Asterisk would incorrectly send both audio and T.38 in the Session Description Protocol (SDP). If this happened and the remote endpoint responded with a declined T.38 stream, Asterisk would crash. The issue affects the res_pjsip_session.c and res_pjsip_t38.c modules. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (NVD).

The vulnerability results in a denial of service condition through a crash of the Asterisk server when specific T.38 fax negotiation conditions are met. This affects remote authenticated sessions and can disrupt voice communication services (Asterisk Advisory).

The vulnerability requires an authenticated remote session and specific timing conditions during T.38 fax protocol negotiation. While the issue was reproducible in controlled environments, there were no known exploits in the wild at the time of disclosure (Asterisk Advisory).

The issue was fixed in Asterisk versions 16.16.1, 17.9.2, 18.2.1, and Certified Asterisk 16.8-cert6. The fix ensures that when re-negotiating for T.38 and a delay occurs, Asterisk only sends SDP for the expected T.38 stream. Additionally, a check was implemented to ensure an active T.38 media stream is active within Asterisk when attempting to change state for fax (Asterisk Advisory).