CVE-2021-43804

Source
https://nvd.nist.gov/vuln/detail/CVE-2021-43804
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43804.json
Aliases
  • GHSA-3qx3-cg72-wrh9
Related
Published
2021-12-22T18:15:07Z
Modified
2023-11-29T09:05:44.382138Z
Details

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.

References

Affected packages

Alpine:v3.16 / pjproject

Package

Name
pjproject

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
2.12-r0

Affected versions

1.*

1.0.1-r0
1.4-r0
1.4-r1
1.6-r0
1.6-r1
1.6-r2
1.10-r0

2.*

2.0-r0
2.1-r0
2.2-r0
2.2.1-r0
2.3-r0
2.4-r0
2.4.5-r0
2.5.5-r0
2.5.5-r1
2.5.5-r2
2.5.5-r3
2.5.5-r4
2.7.2-r0
2.7.2-r1
2.7.2-r2
2.7.2-r3
2.7.2-r4
2.8-r0
2.9-r0
2.11-r0
2.11.1-r0
2.11.1-r1
2.11.1-r2

Alpine:v3.17 / pjproject

Package

Name
pjproject

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
2.12-r0

Affected versions

1.*

1.0.1-r0
1.4-r0
1.4-r1
1.6-r0
1.6-r1
1.6-r2
1.10-r0

2.*

2.0-r0
2.1-r0
2.2-r0
2.2.1-r0
2.3-r0
2.4-r0
2.4.5-r0
2.5.5-r0
2.5.5-r1
2.5.5-r2
2.5.5-r3
2.5.5-r4
2.7.2-r0
2.7.2-r1
2.7.2-r2
2.7.2-r3
2.7.2-r4
2.8-r0
2.9-r0
2.11-r0
2.11.1-r0
2.11.1-r1
2.11.1-r2

Alpine:v3.18 / pjproject

Package

Name
pjproject

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
2.12-r0

Affected versions

1.*

1.0.1-r0
1.4-r0
1.4-r1
1.6-r0
1.6-r1
1.6-r2
1.10-r0

2.*

2.0-r0
2.1-r0
2.2-r0
2.2.1-r0
2.3-r0
2.4-r0
2.4.5-r0
2.5.5-r0
2.5.5-r1
2.5.5-r2
2.5.5-r3
2.5.5-r4
2.7.2-r0
2.7.2-r1
2.7.2-r2
2.7.2-r3
2.7.2-r4
2.8-r0
2.9-r0
2.11-r0
2.11.1-r0
2.11.1-r1
2.11.1-r2

Git / github.com/pjsip/pjproject

Affected ranges

Type
GIT
Repo
https://github.com/pjsip/pjproject
Events
Introduced
0The exact introduced commit is unknown
Fixed
8b621f192cae14456ee0b0ade52ce6c6f258af1e

Affected versions

2.*

2.10
2.11