CVE-2021-21375 Crash in receiving updated SDP answer after initial SDP negotiation failed
An attacker can cause a denial of service by sending specific SIP responses that trigger a crash in the PJSIP library during SDP negotiation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21375?
CVE-2021-21375 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 10 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service.
Which versions are affected by CVE-2021-21375?
It affects 2 products.
Products include Debian Debian Linux, Teluu Pjsip.
How do I fix CVE-2021-21375?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21375 being exploited?
There is no known exploitation of CVE-2021-21375 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-21375, DEBIAN-CVE-2021-21375, DLA-2636-1, DLA-2665-1, GHSA-hvq6-f89p-frvp, MGASA-2021-0336 and 1 more.