PT-2019-14995 · W3C+1 · Webrtc+1

Published 2019-10-05 · Updated 2024-08-05 · CVE-2019-17192

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Signal Private Messenger versions through 4.47.7 for Android

Description The issue is related to the WebRTC component in the Signal Private Messenger application, which processes videoconferencing RTP packets before a callee chooses to answer a call. This behavior might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. The vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs.

Recommendations For Signal Private Messenger versions through 4.47.7 for Android, consider disabling the WebRTC component until a design change or further guidance is provided by the vendor. As a temporary workaround, restrict the use of videoconferencing features to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2019-17192

Affected Products

Signal Private Messenger

Webrtc

References · 7

• https://osv.dev/vulnerability/CVE-2019-17192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17192 · Security Note
• https://news.ycombinator.com/item?id=21161432 · Note
• https://t.me/cvenotify/89098 · Telegram Post
• https://t.me/cvenotify/28595 · Telegram Post
• https://twitter.com/moxie/status/1180226374851710976 · Note
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1936 · Note