CVE-2021-37706: teluu pjsip +3 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-37706

CVSS 9.8 · Critical EPSS 4,6%

Kerentanan Integer Underflow (Wrap or Wraparound) pada teluu pjsip, certified asterisk +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.

Rincian

Terbit di NVD: 22 Desember 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-191: Integer Underflow (Wrap or Wraparound)
EPSS (30 hari): 4,6% peluang dieksploitasi; lebih tinggi dari 91,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
teluu	pjsip	Semua versi hingga 2.11.1
asterisk	certified asterisk	Semua versi sebelum 16.8.0
asterisk	certified asterisk	Versi 16.8.0
asterisk	certified asterisk	Versi 16.8.0 cert1
asterisk	certified asterisk	Versi 16.8.0 cert10
asterisk	certified asterisk	Versi 16.8.0 cert11
asterisk	certified asterisk	Versi 16.8.0 cert12
asterisk	certified asterisk	Versi 16.8.0 cert2
asterisk	certified asterisk	Versi 16.8.0 cert3
asterisk	certified asterisk	Versi 16.8.0 cert4
asterisk	certified asterisk	Versi 16.8.0 cert5
asterisk	certified asterisk	Versi 16.8.0 cert6
asterisk	certified asterisk	Versi 16.8.0 cert7
asterisk	certified asterisk	Versi 16.8.0 cert8
asterisk	certified asterisk	Versi 16.8.0 cert9
sangoma	asterisk	Versi 16.0.0 hingga sebelum 16.24.1
sangoma	asterisk	Versi 18.0.0 hingga sebelum 18.10.1
sangoma	asterisk	Versi 19.0.0 hingga sebelum 19.2.1
debian	debian linux	Versi 9.0
debian	debian linux	Versi 10.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://seclists.org/fulldisclosure/2022/Mar/0 mailing list · patch · advisory pihak ketiga
https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865 patch · advisory pihak ketiga
https://github.com/pjsip/pjproject/security/advisories/GHSA-2qpg-f6wf-w984 patch · advisory pihak ketiga
http://packetstormsecurity.com/files/166225/Asterisk-Project-Security-Advisory-AST-2022-004.html advisory pihak ketiga · vdb entry
https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202210-37 advisory pihak ketiga
https://www.debian.org/security/2022/dsa-5285 advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.