CVE-2020-15260: fallo de gravedad media en pjsip pjproject
Existing TLS connections can be reused without checking remote hostname
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.8epss 1.0%
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.10 and earlier, PJSIP transport can be reused if they have the same IP address + port + protocol. However, this is insufficient for secure transport since it lacks remote hostname authentication. Suppose we have created a TLS connection to `sip.foo.com`, which has an IP address `100.1.1.1`. If we want to create a TLS connection to another hostname, say `sip.bar.com`, which has the same IP address, then it will reuse that existing connection, even though `100.1.1.1` does not have certificate to authenticate as `sip.bar.com`. The vulnerability allows for an insecure interaction without user awareness. It affects users who need access to connections to different destinations that translate to the same address, and allows man-in-the-middle attack if attacker can route a connection to another destination such as in the case of DNS spoofing.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Productos afectados
pjsip · pjprojectCVEs relacionadas — pjsip pjproject
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-37706HIGHPotential integer underflow upon receiving STUN message in PJSIPEPSS 4.9%CVE-2022-21723CRITICALOut-of-bounds read in multipart parsing in PJSIPEPSS 4.4%CVE-2022-23608HIGHUse after free in PJSIPEPSS 4.0%CVE-2021-43845HIGHPrevent out-of-bounds read in PJSIPEPSS 3.9%CVE-2022-24764HIGHStack buffer overflow in pjprojectEPSS 2.4%CVE-2022-21722CRITICALPotential out-of-bound read during RTP/RTCP parsing in PJSIPEPSS 2.3%