Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2021-32686
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-23 Jul, 2021 | 00:00
Updated At-03 Aug, 2024 | 23:25
Rejected At-
▼CVE Numbering Authority (CNA)
Denial of Service in PJSIP

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.

Affected Products
Vendor
pjsip
Product
pjproject
Versions
Affected
  • < 2.11.1
Problem Types
TypeCWE IDDescription
CWECWE-362CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Metrics
VersionBase scoreBase severityVector
3.15.9MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/pjsip/pjproject/security/advisories/GHSA-cv8x-p47p-99wr
N/A
https://github.com/pjsip/pjproject/pull/2716
N/A
https://github.com/pjsip/pjproject/commit/d5f95aa066f878b0aef6a64e60b61e8626e664cd
N/A
https://github.com/pjsip/pjproject/releases/tag/2.11.1
N/A
https://www.debian.org/security/2021/dsa-4999
vendor-advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
mailing-list
https://security.gentoo.org/glsa/202210-37
vendor-advisory
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/pjsip/pjproject/security/advisories/GHSA-cv8x-p47p-99wr
x_transferred
https://github.com/pjsip/pjproject/pull/2716
x_transferred
https://github.com/pjsip/pjproject/commit/d5f95aa066f878b0aef6a64e60b61e8626e664cd
x_transferred
https://github.com/pjsip/pjproject/releases/tag/2.11.1
x_transferred
https://www.debian.org/security/2021/dsa-4999
vendor-advisory
x_transferred
https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
mailing-list
x_transferred
https://security.gentoo.org/glsa/202210-37
vendor-advisory
x_transferred
Details not found