PT-2021-9742 · Pjsip+2 · Pjsip+2

Published 2021-03-10 · Updated 2026-03-24 · CVE-2020-15260

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PJSIP versions 2.10 and earlier

Description PJSIP is a free and open source multimedia communication library that implements standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. The library has a vulnerability that allows for insecure interaction without user awareness. This occurs because PJSIP transport can be reused if they have the same IP address + port + protocol, but it lacks remote hostname authentication. For example, if a TLS connection is created to sip.foo.com with an IP address 100.1.1.1, and then a connection is attempted to sip.bar.com with the same IP address, the existing connection will be reused, even though 100.1.1.1 does not have a certificate to authenticate as sip.bar.com. This vulnerability affects users who need access to connections to different destinations that translate to the same address and allows for man-in-the-middle attacks if an attacker can route a connection to another destination, such as in the case of DNS spoofing.

Recommendations For PJSIP versions 2.10 and earlier, consider disabling the reuse of existing connections to prevent insecure interactions. As a temporary workaround, restrict access to connections that translate to the same IP address to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-297

CWE-295

Related Identifiers

ALT-PU-2021-2089

ALT-PU-2024-10938

CVE-2020-15260

GHSA-8HCP-HM38-MFPH

MGASA-2021-0337

USN-8122-1

Affected Products

Alt Linux

Pjsip

Ubuntu

References · 36

• https://github.com/pjsip/pjproject/security/advisories/GHSA-8hcp-hm38-mfph · Patch
• https://github.com/pjsip/pjproject/commit/67e46c1ac45ad784db5b9080f5ed8b133c122872 · Patch
• https://github.com/pjsip/pjproject/pull/2663 · Patch
• https://ubuntu.com/security/CVE-2021-43299 · Vendor Advisory
• https://security.gentoo.org/glsa/202107-42 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37706 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21375 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-15260 · Security Note
• https://osv.dev/vulnerability/USN-8122-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43302 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15260 · Security Note
• https://ubuntu.com/security/CVE-2021-43301 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000099 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0337 · Vendor Advisory