CVE-2021-28681: Medium severity webrtc vulnerability
Impact Data channel communication was incorrectly allowed with users who have failed DTLS certificate verification.
This attack requires Attacker knows the ICE password. Only take place during PeerConnection handshake.
This attack can be detected by monitoring PeerConnectionState in all versions of Pion WebRTC.
Patches Users should upgrade to v3.0.15.
The exact patch is https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e
Workarounds Users should listen for when PeerConnectionState changes to PeerConnectionStateFailed. When it enters this state users should not continue using the PeerConnection.
For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/pion/webrtc Email us at team@pion.ly
Thank you to https://github.com/Gaukas for discovering this.
Other sources
Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-28681?
The severity of CVE-2021-28681 is medium with a severity value of 5.3.
What is the impact of CVE-2021-28681?
The impact of CVE-2021-28681 is that data channel communication was incorrectly allowed with users who have failed DTLS certificate verification.
How can CVE-2021-28681 be detected?
CVE-2021-28681 can be detected by monitoring the PeerConnectionState in the application.
What is the affected software of CVE-2021-28681?
The affected software of CVE-2021-28681 is Pion WebRTC before version 3.0.15.
How can I fix CVE-2021-28681?
To fix CVE-2021-28681, update Pion WebRTC to version 3.0.15 or higher.