Log in Start free

Vulnerability · Published Dec 27, 2021 · Assigned by GitHub_M

CVE-2021-43845Prevent out-of-bounds read in PJSIP

High 8.2

In plain English

A high-severity out-of-bounds read in pjproject from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)3.9%top 9.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20pjproject2.12-r0ALPINE-CVE-2021-43845
Alpine:v3.21pjproject2.12-r0ALPINE-CVE-2021-43845
Alpine:v3.22pjproject2.12-r0ALPINE-CVE-2021-43845
Alpine:v3.23pjproject2.12-r0ALPINE-CVE-2021-43845
Alpine:v3.24pjproject2.12-r0ALPINE-CVE-2021-43845
Debian:14asterisk1:18.12.0~dfsg+~cs6.12.40431413-1DEBIAN-CVE-2021-43845
Debian:12ring20230206.0~ds1-1DEBIAN-CVE-2021-43845
Ubuntu:22.04:LTSasteriskno fix listedUBUNTU-CVE-2021-43845
Ubuntu:24.04:LTSasteriskno fix listedUBUNTU-CVE-2021-43845
Ubuntu:25.10asteriskno fix listedUBUNTU-CVE-2021-43845
Ubuntu:26.04:LTSasteriskno fix listedUBUNTU-CVE-2021-43845
Ubuntu:26.10asteriskno fix listedUBUNTU-CVE-2021-43845

Affected products (as reported)

VendorProductVersions
pjsip pjproject <= 2.11.1

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

References