CVE-2021-37706highCWE-191

CVE-2021-37706: falha de alta gravidade em pjsip pjproject

Potential integer underflow upon receiving STUN message in PJSIP

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pjproject+ Monitorar asterisk

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.3epss 4.9%
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
pjsip · pjproject
CVEs relacionadas — pjsip pjproject

No mesmo produto, das mais perigosas para as menos.

CVE-2022-21723CRITICALOut-of-bounds read in multipart parsing in PJSIPEPSS 4.4%CVE-2022-23608HIGHUse after free in PJSIPEPSS 4.0%CVE-2021-43845HIGHPrevent out-of-bounds read in PJSIPEPSS 3.9%CVE-2022-24764HIGHStack buffer overflow in pjprojectEPSS 2.4%CVE-2022-21722CRITICALPotential out-of-bound read during RTP/RTCP parsing in PJSIPEPSS 2.3%CVE-2023-27585HIGHCVE-2023-27585EPSS 2.3%