Log in Start free

Vulnerability · Published Dec 22, 2021 · Assigned by GitHub_M

CVE-2021-43804Out-of-bounds read when parsing RTCP BYE message in PJSIP

High 7.3

In plain English

A high-severity out-of-bounds read in pjproject from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)2.3%top 16.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20pjproject2.12-r0ALPINE-CVE-2021-43804
Alpine:v3.21pjproject2.12-r0ALPINE-CVE-2021-43804
Alpine:v3.22pjproject2.12-r0ALPINE-CVE-2021-43804
Alpine:v3.23pjproject2.12-r0ALPINE-CVE-2021-43804
Alpine:v3.24pjproject2.12-r0ALPINE-CVE-2021-43804
Debian:14asterisk1:18.12.0~dfsg+~cs6.12.40431413-1DEBIAN-CVE-2021-43804
Debian:12ring20230206.0~ds1-1DEBIAN-CVE-2021-43804

Affected products (as reported)

VendorProductVersions
pjsip pjproject <= 2.11.1

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References