Log in Start free

Vulnerability · Published Feb 16, 2022 · Assigned by JFROG

CVE-2021-43302

Critical 9.1

In plain English

A critical-severity out-of-bounds read in pjsip from teluu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)2.2%top 17.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20pjproject2.12-r0ALPINE-CVE-2021-43302
Alpine:v3.21pjproject2.12-r0ALPINE-CVE-2021-43302
Alpine:v3.22pjproject2.12-r0ALPINE-CVE-2021-43302
Alpine:v3.23pjproject2.12-r0ALPINE-CVE-2021-43302
Alpine:v3.24pjproject2.12-r0ALPINE-CVE-2021-43302
Debian:14asterisk1:18.11.1~dfsg+~cs6.10.40431413-1DEBIAN-CVE-2021-43302
Debian:12ring20230206.0~ds1-1DEBIAN-CVE-2021-43302
Ubuntu:22.04:LTSasteriskno fix listedUBUNTU-CVE-2021-43302
Ubuntu:24.04:LTSasteriskno fix listedUBUNTU-CVE-2021-43302
Ubuntu:25.10asteriskno fix listedUBUNTU-CVE-2021-43302
Ubuntu:26.04:LTSasteriskno fix listedUBUNTU-CVE-2021-43302
Ubuntu:26.10asteriskno fix listedUBUNTU-CVE-2021-43302

Affected products (as reported)

VendorProductVersions
teluu pjsip unspecified – through 2.11.1

Weakness: CWE-125

References