CVE-2021-21375: Crash in receiving updated SDP answer after initial SDP negotiation failed
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-21375?
CVE-2021-21375 is a vulnerability in the PJSIP library that allows for a denial of service attack.
What is the severity of CVE-2021-21375?
The severity of CVE-2021-21375 is medium, with a score of 6.5.
Which software versions are affected by CVE-2021-21375?
PJSIP version 2.10 and earlier, as well as Debian Debian Linux 9.0, are affected by CVE-2021-21375.
How can I fix CVE-2021-21375?
To fix CVE-2021-21375, update to a patched version of PJSIP or Debian Debian Linux.
Where can I find more information about CVE-2021-21375?
More information about CVE-2021-21375 can be found in the references provided: [GitHub Commit](https://github.com/pjsip/pjproject/commit/97b3d7addbaa720b7ddb0af9bf6f3e443e664365), [GitHub Security Advisory](https://github.com/pjsip/pjproject/security/advisories/GHSA-hvq6-f89p-frvp), [Debian LTS Announcement](https://lists.debian.org/debian-lts-announce/2021/04/msg00023.html).