CVE-2021-32686: Denial of Service in PJSIP
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-32686?
CVE-2021-32686 is a vulnerability found in the SSL socket of PJSIP before version 2.11.1.
How severe is CVE-2021-32686?
CVE-2021-32686 has a severity score of 5.9, which is considered medium.
How can I fix CVE-2021-32686?
To fix CVE-2021-32686, you should update PJSIP to version 2.11.1 or later.
Is the Debian Debian Linux 9.0 affected by CVE-2021-32686?
Yes, Debian Debian Linux 9.0 is affected by CVE-2021-32686.
Are there any references for CVE-2021-32686?
Yes, you can find more information about CVE-2021-32686 at the following references: [link 1](https://downloads.asterisk.org/pub/security/AST-2021-009.html), [link 2](https://github.com/pjsip/pjproject/security/advisories/GHSA-cv8x-p47p-99wr), [link 3](https://github.com/pjsip/pjproject/commit/d5f95aa066f878b0aef6a64e60b61e8626e664cd).