CVE-2020-15260: Existing TLS connections can be reused without checking remote hostname
First published: Wed Mar 10 2021(Updated: )
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.10 and earlier, PJSIP transport can be reused if they have the same IP address + port + protocol. However, this is insufficient for secure transport since it lacks remote hostname authentication. Suppose we have created a TLS connection to `sip.foo.com`, which has an IP address `100.1.1.1`. If we want to create a TLS connection to another hostname, say `sip.bar.com`, which has the same IP address, then it will reuse that existing connection, even though `100.1.1.1` does not have certificate to authenticate as `sip.bar.com`. The vulnerability allows for an insecure interaction without user awareness. It affects users who need access to connections to different destinations that translate to the same address, and allows man-in-the-middle attack if attacker can route a connection to another destination such as in the case of DNS spoofing.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Teluu PJSIP | <=2.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-15260?
CVE-2020-15260 is a vulnerability in PJSIP, a multimedia communication library, that allows reuse of transport with the same IP address, port, and protocol.
What is the severity of CVE-2020-15260?
CVE-2020-15260 has a severity rating of 6.8 (medium).
How does CVE-2020-15260 affect PJSIP?
CVE-2020-15260 affects PJSIP versions up to and including 2.10.
How can I fix CVE-2020-15260?
To fix CVE-2020-15260, it is recommended to update to a version of PJSIP that is not affected by the vulnerability.
Does CVE-2020-15260 require authentication?
CVE-2020-15260 does not require authentication, making it a potential security risk.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/remedy
- agent/severity
- agent/author
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/teluu
- canonical/teluu pjsip
- version/teluu pjsip/2.10