CVE-2021-43845

 

Published at: - 27-12-2021 07:15

Last modified: - 27-01-2023 08:56

Total changes: - 9

Description

PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

 

Verification logic

 

Reference

• https://github.com/pjsip/pjproject/commit/f74c1fc22b760d2a24369aa72c74c4a9ab985859
• https://github.com/pjsip/pjproject/security/advisories/GHSA-r374-qrwv-86hh
• https://github.com/pjsip/pjproject/pull/2924
• [debian-lts-announce] 20220328 [SECURITY] [DLA 2962-1] pjproject security update-Mailing List, Third Party Advisory
• GLSA-202210-37-Third Party Advisory
• [debian-lts-announce] 20221117 [SECURITY] [DLA 3194-1] asterisk security update-Mailing List, Third Party Advisory
• DSA-5285-Third Party Advisory

 

Keywords

NVD

 

CVE-2021-43845

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures