PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier,     after an initial INVITE has been sent, when two 183 responses are received, with the first one causing     negotiation failure, a crash will occur. This results in a denial of service. (CVE-2021-21375)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202107-42 (PJSIP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PJSIP. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

An issue has been found in ring, a secure and distributed voice, video and chat platform. Actually the embedded copy of pjproject is affected by this CVE. Due to bad handling of two consecutive crafted answers to an INVITE, the attacker is able to crash the server resulting in a denial of service.

For Debian 9 stretch, this problem has been fixed in version 20161221.2.7bd7d91~dfsg1-1+deb9u1.

We recommend that you upgrade your ring packages.

For the detailed security status of ring please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ring

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An issue has been found in pjproject, a set of libraries for the PJ Project. Due to bad handling of two consecutive crafted answers to an INVITE, the attacker is able to crash the server resulting in a denial of service.

For Debian 9 stretch, this problem has been fixed in version 2.5.5~dfsg-6+deb9u2.

We recommend that you upgrade your pjproject packages.

For the detailed security status of pjproject please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/pjproject

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
257696	Linux Distros Unpatched Vulnerability : CVE-2021-21375	Nessus	Misc.	medium
157027	GLSA-202107-42 : PJSIP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
149854	Debian DLA-2665-1 : ring security update	Nessus	Debian Local Security Checks	medium
149003	Debian DLA-2636-1 : pjproject security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2021-21375

medium

Tenable Plugins

medium

medium

medium

medium