CVE-2021-32686CWE-362

Denial of Service in PJSIP

Medium · published July 23, 2021

CVSS v3.1
5.9
EPSS
2%
Percentile
81.2
In the wild
Unconfirmed
What it is

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02065 · 81.2th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2021-07-23T00:00Z
EPSS history
Timeline
  • 23 JUL 00:00Z
    Denial of Service in PJSIP
    cvelistv5