CVE-2021-28681 In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication
Attackers can bypass DTLS certificate verification in Pion WebRTC by continuing to use a PeerConnection after verification failure, undermining secure communication guarantees.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28681?
CVE-2021-28681 is a medium-severity vulnerability in n/a, published on 18 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)
Weakness: CWE-863
Which versions are affected by CVE-2021-28681?
3 open source packages ship an affected version, including github.com/pion/webrtc/v3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pion/webrtc/v3 Go | All versions | 3.0.15 |
github.com/pion/webrtc/v3 Go | All versions | 3.0.15 |
github.com/pion/webrtc/v3 Go | All versions | 3.0.15 |
Products include Webrtc Project Webrtc.
How do I fix CVE-2021-28681?
Upgrade github.com/pion/webrtc/v3 to 3.0.15 or later.
Is CVE-2021-28681 being exploited?
There is no known exploitation of CVE-2021-28681 in the wild and no public exploit code.
Sources
Also known as GHSA-74xm-qj29-cq8p, GO-2021-0104.