CVE-2021-43804

Name	CVE-2021-43804
Description	PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2962-1, DLA-3194-1, DLA-3549-1, DLA-3887-1, DSA-5285-1
Debian Bugs	1014998

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
asterisk (PTS)	forky, sid	1:22.10.1+dfsg+~cs6.17.60671434-1	fixed
ring (PTS)	bookworm, bookworm (security)	20230206.0~ds2-1.1+deb12u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
asterisk	source	stretch	(not affected)
asterisk	source	buster	1:16.28.0~dfsg-0+deb10u1	DLA-3194-1
asterisk	source	bullseye	1:16.28.0~dfsg-0+deb11u1	DSA-5285-1
asterisk	source	(unstable)	1:18.12.0~dfsg+~cs6.12.40431413-1
pjproject	source	stretch	2.5.5~dfsg-6+deb9u3	DLA-2962-1
pjproject	source	(unstable)	(unfixed)
ring	source	buster	20190215.1.f152c98~ds1-1+deb10u2	DLA-3549-1
ring	source	bullseye	20210112.2.b757bac~ds1-1+deb11u1	DLA-3887-1
ring	source	(unstable)	20230206.0~ds1-1		1014998

Notes

[stretch] - asterisk <not-affected> (Vulnerable code not present)
https://github.com/pjsip/pjproject/security/advisories/GHSA-3qx3-cg72-wrh9
https://github.com/pjsip/pjproject/commit/8b621f192cae14456ee0b0ade52ce6c6f258af1e