CVE-2021-32686

Katalog CVE

CVSS 5.9 · Medium EPSS 2,1%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada teluu pjsip, debian linux. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.

Rincian

Terbit di NVD

23 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 80,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pjsip/pjproject/commit/d5f95aa066f878b0aef6a64e60b61e8626e664cd patch · advisory pihak ketiga
• https://github.com/pjsip/pjproject/pull/2716 patch · advisory pihak ketiga
• https://github.com/pjsip/pjproject/releases/tag/2.11.1 release notes · advisory pihak ketiga
• https://github.com/pjsip/pjproject/security/advisories/GHSA-cv8x-p47p-99wr advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202210-37 advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4999 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html