CVE-2021-43804

 

Published at: - 22-12-2021 07:15

Last modified: - 18-11-2022 05:15

Total changes: - 8

Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

 

Verification logic

 

Reference

• https://github.com/pjsip/pjproject/security/advisories/GHSA-3qx3-cg72-wrh9
• https://github.com/pjsip/pjproject/commit/8b621f192cae14456ee0b0ade52ce6c6f258af1e
• [debian-lts-announce] 20220328 [SECURITY] [DLA 2962-1] pjproject security update-Mailing List, Third Party Advisory
• GLSA-202210-37-Third Party Advisory
• [debian-lts-announce] 20221117 [SECURITY] [DLA 3194-1] asterisk security update-
• DSA-5285-

 

Keywords

NVD

 

CVE-2021-43804

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures