Log in Start free

Vulnerability · Published Feb 16, 2022 · Assigned by JFROG

CVE-2021-43303

Critical 9.8

In plain English

A critical-severity buffer overflow in pjsip from teluu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.4%top 16.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an output buffer smaller than 128 characters may overflow the output buffer, regardless of the 'maxlen' argument supplied

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20pjproject2.12-r0ALPINE-CVE-2021-43303
Alpine:v3.21pjproject2.12-r0ALPINE-CVE-2021-43303
Alpine:v3.22pjproject2.12-r0ALPINE-CVE-2021-43303
Alpine:v3.23pjproject2.12-r0ALPINE-CVE-2021-43303
Alpine:v3.24pjproject2.12-r0ALPINE-CVE-2021-43303
Debian:14asterisk1:18.11.1~dfsg+~cs6.10.40431413-1DEBIAN-CVE-2021-43303
Debian:12ring20230206.0~ds1-1DEBIAN-CVE-2021-43303
Ubuntu:22.04:LTSasteriskno fix listedUBUNTU-CVE-2021-43303
Ubuntu:24.04:LTSasteriskno fix listedUBUNTU-CVE-2021-43303
Ubuntu:25.10asteriskno fix listedUBUNTU-CVE-2021-43303
Ubuntu:26.04:LTSasteriskno fix listedUBUNTU-CVE-2021-43303
Ubuntu:26.10asteriskno fix listedUBUNTU-CVE-2021-43303

Affected products (as reported)

VendorProductVersions
teluu pjsip unspecified – through 2.11.1

Weakness: CWE-120

References