CVE-2021-21375
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Summary
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| pjsip | pjproject | <= 2.10 | affected |
Weaknesses
- CWE-400: CWE-400 Uncontrolled Resource Consumption
ADP Enrichment
CVE Program Container
Additional References
- https://github.com/pjsip/pjproject/security/advisories/GHSA-hvq6-f89p-frvp
- https://github.com/pjsip/pjproject/commit/97b3d7addbaa720b7ddb0af9bf6f3e443e664365
- https://lists.debian.org/debian-lts-announce/2021/04/msg00023.html
- https://lists.debian.org/debian-lts-announce/2021/05/msg00020.html
- https://security.gentoo.org/glsa/202107-42
References
- https://github.com/pjsip/pjproject/security/advisories/GHSA-hvq6-f89p-frvp
- https://github.com/pjsip/pjproject/commit/97b3d7addbaa720b7ddb0af9bf6f3e443e664365
- https://lists.debian.org/debian-lts-announce/2021/04/msg00023.html
- https://lists.debian.org/debian-lts-announce/2021/05/msg00020.html
- https://security.gentoo.org/glsa/202107-42
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.