CVE-2021-43845
PJSIP is a free and open source multimedia communication library. In v ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Ubuntu (media).
Descripción
PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.16 | pjproject | 2.12-r0 |
| alpine 3.17 | pjproject | 2.12-r0 |
| alpine 3.18 | pjproject | 2.12-r0 |
| alpine 3.19 | pjproject | 2.12-r0 |
| alpine 3.20 | pjproject | 2.12-r0 |
| alpine 3.21 | pjproject | 2.12-r0 |
| alpine 3.22 | pjproject | 2.12-r0 |
| alpine 3.23 | pjproject | 2.12-r0 |
| alpine 3.24 | pjproject | 2.12-r0 |
| alpine edge | pjproject | 2.12-r0 |
| debian 10 | asterisk, ring | 1:16.28.0~dfsg-0+deb10u1 y 1 más |
| debian 11 | asterisk, ring | 1:16.28.0~dfsg-0+deb11u1 y 1 más |
Mostrar las 22 entradas de 19 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.16 | pjproject | 2.12-r0 |
| alpine 3.17 | pjproject | 2.12-r0 |
| alpine 3.18 | pjproject | 2.12-r0 |
| alpine 3.19 | pjproject | 2.12-r0 |
| alpine 3.20 | pjproject | 2.12-r0 |
| alpine 3.21 | pjproject | 2.12-r0 |
| alpine 3.22 | pjproject | 2.12-r0 |
| alpine 3.23 | pjproject | 2.12-r0 |
| alpine 3.24 | pjproject | 2.12-r0 |
| alpine edge | pjproject | 2.12-r0 |
| debian 10 | asterisk | 1:16.28.0~dfsg-0+deb10u1 |
| debian 10 | ring | 20190215.1.f152c98~ds1-1+deb10u2 |
| debian 11 | asterisk | 1:16.28.0~dfsg-0+deb11u1 |
| debian 11 | ring | 20210112.2.b757bac~ds1-1+deb11u1 |
| debian 12 | ring | 20230206.0~ds1-1 |
| debian 14 | asterisk | 1:18.12.0~dfsg+~cs6.12.40431413-1 |
| debian 9 | pjproject | 2.5.5~dfsg-6+deb9u3 |
| echo | ring | 20230206.0~ds1-1 |
| ubuntu 18.04-ESM | pjproject | sin corrección indicada |
| ubuntu 18.04-ESM | ring | 20180228.1.503da2b~ds1-1ubuntu0.1~esm1 |
| ubuntu 20.04 | ring | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
| ubuntu 20.04-ESM | ring | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
Referencias
- https://github.com/pjsip/pjproject/commit/f74c1fc22b760d2a24369aa72c74c4a9ab985859
- https://github.com/pjsip/pjproject/pull/2924
- https://github.com/pjsip/pjproject/security/advisories/GHSA-r374-qrwv-86hh
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://security.gentoo.org/glsa/202210-37