PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when error/failure occurs, it is found that the function returns without releasing the currently held locks. This could result in a system deadlock, which cause a denial of service for the users. No release has yet been made which contains the linked fix commit. All versions up to an including 2.11.1 are affected. Users may need to manually apply the patch.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PJSIP is a free and open source multimedia communication library written in the C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when     error/failure occurs, it is found that the function returns without releasing the currently held locks.
    This could result in a system deadlock, which cause a denial of service for the users. No release has yet     been made which contains the linked fix commit. All versions up to an including 2.11.1 are affected. Users     may need to manually apply the patch. (CVE-2021-41141)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - PJSIP is a free and open source multimedia communication library written in C language implementing
    standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming
    STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a
    subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all
    users that use STUN. A malicious actor located within the victim’s network may forge and send a specially
    crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are
    advised to upgrade as soon as possible. There are no known workarounds. (CVE-2021-37706)

  - PJSIP is a free and open source multimedia communication library written in the C language implementing
    standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when
    error/failure occurs, it is found that the function returns without releasing the currently held locks.
    This could result in a system deadlock, which cause a denial of service for the users. No release has yet
    been made which contains the linked fix commit. All versions up to an including 2.11.1 are affected. Users
    may need to manually apply the patch. (CVE-2021-41141)

  - Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument
    may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
    (CVE-2021-43299)

  - Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument
    may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
    (CVE-2021-43300)

The remote host is affected by the vulnerability described in GLSA-202210-37 (PJSIP: Multiple Vulnerabilities)

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there     are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due     to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed     during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They     cause a crash, resulting in a denial of service. These are fixed in version 2.11.1. (CVE-2021-32686)

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming     STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a     subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all     users that use STUN. A malicious actor located within the victim's network may forge and send a specially     crafted UDP (STUN) message that could remotely execute arbitrary code on the victim's machine. Users are     advised to upgrade as soon as possible. There are no known workarounds. (CVE-2021-37706)

  - PJSIP is a free and open source multimedia communication library written in the C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when     error/failure occurs, it is found that the function returns without releasing the currently held locks.
    This could result in a system deadlock, which cause a denial of service for the users. No release has yet     been made which contains the linked fix commit. All versions up to an including 2.11.1 are affected. Users     may need to manually apply the patch. (CVE-2021-41141)

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming     RTCP BYE message contains a reason's length, this declared length is not checked against the actual     received packet size, potentially resulting in an out-of-bound read access. This issue affects all users     that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length.
    Users are advised to upgrade as soon as possible. There are no known workarounds. (CVE-2021-43804)

  - PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming     RTCP XR message contain block, the data field is not checked against the received packet size, potentially     resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious     actor can send a RTCP XR message with an invalid packet size. (CVE-2021-43845)

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there     are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-     of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch     is available as a commit in the `master` branch. There are no known workarounds. (CVE-2022-21722)

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing     an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read     access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in     the `master` branch. There are no known workarounds. (CVE-2022-21723)

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including     2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can     potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set     to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior     such as dialog list collision which eventually leading to endless loop. A patch is available in commit     db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known     workarounds for this issue. (CVE-2022-23608)

  - PJSIP is a free and open source multimedia communication library written in C language. In versions prior     to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users     who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has     been patched in the master branch of the PJSIP repository and will be included with the next release.
    Users unable to upgrade need to check that the hashed digest data length must be equal to     `PJSIP_MD5STRLEN` before passing to PJSIP. (CVE-2022-24754)

  - PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12     and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML     parsing in their apps. Users are advised to update. There are no known workarounds. (CVE-2022-24763)

  - PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior     contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API     `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly     call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on     the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
    (CVE-2022-24764)

  - PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and     prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any     app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master`     branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
    (CVE-2022-24786)

  - PJSIP is a free and open source multimedia communication library written in C. A denial-of-service     vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read     invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than     31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays     trusted WAV files. A patch is available on the `master` branch of the `pjsip/project` GitHub repository.
    As a workaround, apps can reject a WAV file received from an unknown source or validate the file first.
    (CVE-2022-24792)

  - PJSIP is a free and open source multimedia communication library written in C. A buffer overflow     vulnerability in versions 2.12 and prior affects applications that uses PJSIP DNS resolution. It doesn't     affect PJSIP users who utilize an external resolver. A patch is available in the `master` branch of the     `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting     `nameserver_count` to zero) or use an external resolver instead. (CVE-2022-24793)

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including     2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications,     either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using     `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next     release. There are no known workarounds for this issue. (CVE-2022-31031)

  - PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior     to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow     vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is     available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users     are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-39244)

  - PJSIP is a free and open source multimedia communication library written in C. When processing certain     packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP     restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP.
    The patch is available as commit d2acb9a in the master branch of the project and will be included in     version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this     vulnerability. (CVE-2022-39269)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2962 advisory.

    Multiple security issues were discovered in pjproject, is a free and open source multimedia communication     library. CVE-2021-32686 A race condition between callback and destroy, due to the accepted socket having     no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. s. They cause     crash, resulting in a denial of service. CVE-2021-37706 An incoming STUN message contains an ERROR-CODE     attribute, the header length is not checked before performing a subtraction operation, potentially     resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor     located within the victims network may forge and send a specially crafted UDP (STUN) message that could     remotely execute arbitrary code on the victims machine CVE-2021-41141 In various parts of PJSIP, when     error/failure occurs, it is found that the function returns without releasing the currently held locks.
    This could result in a system deadlock, which cause a denial of service for the users. CVE-2021-43299     Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled filename argument may     cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.
    CVE-2021-43300 Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled     filename argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any     size validation. CVE-2021-43301 Stack overflow in PJSUA API when calling pjsua_playlist_create. An     attacker-controlled file_names argument may cause a buffer overflow since it is copied to a fixed-size     stack buffer without any size validation. CVE-2021-43302 Read out-of-bounds in PJSUA API when calling     pjsua_recorder_create. An attacker-controlled filename argument may cause an out-of-bounds read when the     filename is shorter than 4 characters. CVE-2021-43303 Buffer overflow in PJSUA API when calling     pjsua_call_dump. An attacker-controlled buffer argument may cause a buffer overflow, since supplying an     output buffer smaller than 128 characters may overflow the output buffer, regardless of the maxlen     argument supplied CVE-2021-43804 An incoming RTCP BYE message contains a reason's length, this declared     length is not checked against the actual received packet size, potentially resulting in an out-of-bound     read access. A malicious actor can send a RTCP BYE message with an invalid reason length CVE-2021-43845 if     incoming RTCP XR message contain block, the data field is not checked against the received packet size,     potentially resulting in an out-of-bound read access CVE-2022-21722 it is possible that certain incoming     RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use     PJMEDIA and accept incoming RTP/RTCP. CVE-2022-21723 Parsing an incoming SIP message that contains a     malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users     that accept SIP multipart. CVE-2022-23608 When in a dialog set (or forking) scenario, a hash key shared by     multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue     may cause a dialog set to be registered in the hash table multiple times (with different hash keys)     leading to undefined behavior such as dialog list collision which eventually leading to endless loop     CVE-2022-24754 There is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept     hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). CVE-2022-24764 A stack     buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(),     pjmedia_sdp_media_print()` For Debian 9 stretch, these problems have been fixed in version     2.5.5~dfsg-6+deb9u3. We recommend that you upgrade your pjproject packages. For the detailed security     status of pjproject please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/pjproject Further information about Debian LTS security advisories, how to     apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
261041	Linux Distros Unpatched Vulnerability : CVE-2021-41141	Nessus	Misc.	high
424347	Alpine: multiple pjproject packages: security update to 2.12-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424347	Alpine: multiple pjproject packages: security update to 2.12-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
166740	GLSA-202210-37 : PJSIP: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
159329	Debian DLA-2962-1 : pjproject - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2021-41141

high

Tenable Plugins

high

critical

critical

critical

critical