← Back

CVE-2021-37706

nvd nist
Published: Dec 22, 2021Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.

Affected (20)

Products: Teluu: Pjsip · Asterisk: Certified Asterisk · Sangoma: Asterisk · +1 more
Show all products
Teluu: Pjsip · Asterisk: Certified Asterisk · Sangoma: Asterisk · Debian: Debian Linux
Teluu
1 product
Pjsip
Asterisk
1 product
Certified Asterisk
Sangoma
1 product
Asterisk
Debian
1 product
Debian Linux
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Pjsip
Up to 2.11.1
Configuration B
17 vulnerable
Vulnerable SoftwareAffected Versions
Asterisk
Certified Asterisk
Before 16.8.0
Certified Asterisk
Version 16.8.0
Certified Asterisk
Version 16.8.0 cert10
Certified Asterisk
Version 16.8.0 cert11
Certified Asterisk
Version 16.8.0 cert12
Certified Asterisk
Version 16.8.0 cert1
Certified Asterisk
Version 16.8.0 cert2
Certified Asterisk
Version 16.8.0 cert3
Certified Asterisk
Version 16.8.0 cert4
Certified Asterisk
Version 16.8.0 cert5
Certified Asterisk
Version 16.8.0 cert6
Certified Asterisk
Version 16.8.0 cert7
Certified Asterisk
Version 16.8.0 cert8
Certified Asterisk
Version 16.8.0 cert9
Sangoma
Asterisk
From 16.0.0 to 16.24.1
Asterisk
From 18.0.0 to 18.10.1
Asterisk
From 19.0.0 to 19.2.1
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 9.0

Related CWEs

CWE-191
Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

References (19)

Source: security-advisories@github.com
Third Party AdvisoryVDB Entry
Source: security-advisories@github.com
Mailing ListPatchThird Party Advisory
Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
Mailing ListThird Party Advisory
Source: security-advisories@github.com
Mailing ListThird Party Advisory
Source: security-advisories@github.com
Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.