9.8
CVE-2021-37706
- EPSS 0.1%
- Published 22.12.2021 18:15:07
- Last modified 21.11.2024 06:15:45
- Source security-advisories@github.com
- Teams watchlist Login
- Open Login
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.
Data is provided by the National Vulnerability Database (NVD)
Asterisk ≫ Certified Asterisk Version < 16.8.0
Asterisk ≫ Certified Asterisk Version16.8.0
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert1
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert10
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert11
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert12
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert2
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert3
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert4
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert5
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert6
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert7
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert8
Asterisk ≫ Certified Asterisk Version16.8.0 Updatecert9
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.1% | 0.281 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 9.3 | 8.6 | 10 |
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
| security-advisories@github.com | 7.3 | 3.9 | 3.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
|
CWE-191 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.