PT-2022-2181 · Pjsip+1 · Pjsip+1

Ryancaicse + 1 · Published 2022-01-04 · Updated 2024-11-25 · CVE-2021-41141

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PJSIP versions up to and including 2.11.1

Description The issue is related to synchronization errors when using shared resources in the PJSIP library. When an error or failure occurs in various parts of PJSIP, the function returns without releasing the currently held locks, potentially resulting in a system deadlock and causing a denial of service for users.

Recommendations For versions up to and including 2.11.1, users may need to manually apply the patch, as no release has yet been made that contains the linked fix commit. As a temporary workaround, consider restricting access to shared resources to minimize the risk of exploitation.

Fix

DoS

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

ALT-PU-2024-15954

ALT-PU-2024-16030

BDU:2022-02207

CVE-2021-41141

DLA-2962-1

GHSA-8FMX-HQW7-6GMC

Affected Products

Alt Linux

Pjsip

References · 15

• https://github.com/pjsip/pjproject/security/advisories/GHSA-8fmx-hqw7-6gmc · Patch
• https://github.com/pjsip/pjproject/commit/1aa2c0e0fb60a1b0bf793e0d834073ffe50fb196 · Patch
• https://bdu.fstec.ru/vul/2022-02207 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41141 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2962-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41141 · Security Note
• https://ubuntu.com/security/CVE-2021-41141 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-37 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41141 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41141 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-41141 · Vendor Advisory
• https://security.alpinelinux.org/vuln/CVE-2021-41141 · Note
• https://t.me/cibsecurity/34961 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html · Note
• https://t.me/cvenotify/31143 · Telegram Post