CVE-2021-43804

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.

References

Affected packages

Git / github.com/pjsip/pjproject

Affected ranges

Type: GIT
Repo: https://github.com/pjsip/pjproject
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

8b621f192cae14456ee0b0ade52ce6c6f258af1e

Affected versions

2.*

2.10

2.11

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/pjsip/pjproject/commit/8b621f192cae14456ee0b0ade52ce6c6f258af1e",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2021-43804-21f02fcb",
        "target": {
            "file": "pjmedia/src/pjmedia/rtcp.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "103894779853426178814937399479854292327",
                "130803791047819453649259362093641933649",
                "122525548633403368601872048441338313566",
                "129850034086129389672742617489432174938",
                "106737951759900644022218887804782806478",
                "169713399488750805111827828987683376328"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://github.com/pjsip/pjproject/commit/8b621f192cae14456ee0b0ade52ce6c6f258af1e",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2021-43804-252f8bbe",
        "target": {
            "function": "parse_rtcp_bye",
            "file": "pjmedia/src/pjmedia/rtcp.c"
        },
        "digest": {
            "length": 456.0,
            "function_hash": "276740140683552634685635405292978235453"
        },
        "signature_type": "Function"
    }
]