CVE-2021-21375: Crash in receiving updated SDP answer after initial SDP negotiation failed
First published: Wed Mar 10 2021(Updated: )
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Teluu PJSIP | <=2.10 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/pjsip/pjproject/commit/97b3d7addbaa720b7ddb0af9bf6f3e443e664365
- https://github.com/pjsip/pjproject/security/advisories/GHSA-hvq6-f89p-frvp
- https://lists.debian.org/debian-lts-announce/2021/04/msg00023.html
- https://lists.debian.org/debian-lts-announce/2021/05/msg00020.html
- https://security.gentoo.org/glsa/202107-42
Frequently Asked Questions
What is CVE-2021-21375?
CVE-2021-21375 is a vulnerability in the PJSIP library that allows for a denial of service attack.
What is the severity of CVE-2021-21375?
The severity of CVE-2021-21375 is medium, with a score of 6.5.
Which software versions are affected by CVE-2021-21375?
PJSIP version 2.10 and earlier, as well as Debian Debian Linux 9.0, are affected by CVE-2021-21375.
How can I fix CVE-2021-21375?
To fix CVE-2021-21375, update to a patched version of PJSIP or Debian Debian Linux.
Where can I find more information about CVE-2021-21375?
More information about CVE-2021-21375 can be found in the references provided: [GitHub Commit](https://github.com/pjsip/pjproject/commit/97b3d7addbaa720b7ddb0af9bf6f3e443e664365), [GitHub Security Advisory](https://github.com/pjsip/pjproject/security/advisories/GHSA-hvq6-f89p-frvp), [Debian LTS Announcement](https://lists.debian.org/debian-lts-announce/2021/04/msg00023.html).
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/last-modified-date
- agent/title
- agent/author
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/teluu
- canonical/teluu pjsip
- version/teluu pjsip/2.10
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0