CVE-2021-43845
PJSIP is a free and open source multimedia communication library. In v ...
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Ubuntu (moyenne).
Description
PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.16 | pjproject | 2.12-r0 |
| alpine 3.17 | pjproject | 2.12-r0 |
| alpine 3.18 | pjproject | 2.12-r0 |
| alpine 3.19 | pjproject | 2.12-r0 |
| alpine 3.20 | pjproject | 2.12-r0 |
| alpine 3.21 | pjproject | 2.12-r0 |
| alpine 3.22 | pjproject | 2.12-r0 |
| alpine 3.23 | pjproject | 2.12-r0 |
| alpine 3.24 | pjproject | 2.12-r0 |
| alpine edge | pjproject | 2.12-r0 |
| debian 10 | asterisk, ring | 1:16.28.0~dfsg-0+deb10u1 et 1 autres |
| debian 11 | asterisk, ring | 1:16.28.0~dfsg-0+deb11u1 et 1 autres |
Afficher les 22 entrées de 19 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.16 | pjproject | 2.12-r0 |
| alpine 3.17 | pjproject | 2.12-r0 |
| alpine 3.18 | pjproject | 2.12-r0 |
| alpine 3.19 | pjproject | 2.12-r0 |
| alpine 3.20 | pjproject | 2.12-r0 |
| alpine 3.21 | pjproject | 2.12-r0 |
| alpine 3.22 | pjproject | 2.12-r0 |
| alpine 3.23 | pjproject | 2.12-r0 |
| alpine 3.24 | pjproject | 2.12-r0 |
| alpine edge | pjproject | 2.12-r0 |
| debian 10 | asterisk | 1:16.28.0~dfsg-0+deb10u1 |
| debian 10 | ring | 20190215.1.f152c98~ds1-1+deb10u2 |
| debian 11 | asterisk | 1:16.28.0~dfsg-0+deb11u1 |
| debian 11 | ring | 20210112.2.b757bac~ds1-1+deb11u1 |
| debian 12 | ring | 20230206.0~ds1-1 |
| debian 14 | asterisk | 1:18.12.0~dfsg+~cs6.12.40431413-1 |
| debian 9 | pjproject | 2.5.5~dfsg-6+deb9u3 |
| echo | ring | 20230206.0~ds1-1 |
| ubuntu 18.04-ESM | pjproject | pas de correctif indiqué |
| ubuntu 18.04-ESM | ring | 20180228.1.503da2b~ds1-1ubuntu0.1~esm1 |
| ubuntu 20.04 | ring | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
| ubuntu 20.04-ESM | ring | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
Références
- https://github.com/pjsip/pjproject/commit/f74c1fc22b760d2a24369aa72c74c4a9ab985859
- https://github.com/pjsip/pjproject/pull/2924
- https://github.com/pjsip/pjproject/security/advisories/GHSA-r374-qrwv-86hh
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://security.gentoo.org/glsa/202210-37