PT-2021-14457 · Pjsip+2 · Pjsip+2

Sauwming · Published 2021-03-10 · Updated 2026-03-24 · CVE-2021-21375

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PJSIP versions 2.10 and earlier

Description PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service.

Recommendations For PJSIP versions 2.10 and earlier, update to a version later than 2.10 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Check for Exceptional Conditions

Resource Exhaustion

Weakness Enumeration

CWE-754

CWE-400

Related Identifiers

ALT-PU-2021-2089

ALT-PU-2024-10938

CVE-2021-21375

DLA-2636-1

DLA-2665-1

GHSA-HVQ6-F89P-FRVP

MGASA-2021-0336

MGASA-2021-0337

USN-8122-1

Affected Products

Alt Linux

Pjsip

Ubuntu

References · 42

• 🔥 https://github.com/pjsip/pjproject/security/advisories/GHSA-hvq6-f89p-frvp · Exploit
• https://github.com/pjsip/pjproject/commit/97b3d7addbaa720b7ddb0af9bf6f3e443e664365 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21375 · Security Note
• https://security.gentoo.org/glsa/202107-42 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0336.html · Security Note
• https://advisories.mageia.org/MGASA-2021-0337.html · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0337 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-21375 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32686 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43301 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43302 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000098 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16872 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000099 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0336 · Vendor Advisory