{"id":"CVE-2021-37706","details":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.","aliases":["GHSA-2qpg-f6wf-w984"],"modified":"2026-07-09T11:34:15.721463Z","published":"2021-12-22T18:15:07.487Z","related":["USN-6422-2"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert10:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert11:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert12:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert1:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert2:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert3:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert4:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert5:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert6:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert7:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert8:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"16.8.0-cert1"},{"last_affected":"16.8.0-cert1"},{"introduced":"16.8.0-cert10"},{"last_affected":"16.8.0-cert10"},{"introduced":"16.8.0-cert11"},{"last_affected":"16.8.0-cert11"},{"introduced":"16.8.0-cert12"},{"last_affected":"16.8.0-cert12"},{"introduced":"16.8.0-cert2"},{"last_affected":"16.8.0-cert2"},{"introduced":"16.8.0-cert3"},{"last_affected":"16.8.0-cert3"},{"introduced":"16.8.0-cert4"},{"last_affected":"16.8.0-cert4"},{"introduced":"16.8.0-cert5"},{"last_affected":"16.8.0-cert5"},{"introduced":"16.8.0-cert6"},{"last_affected":"16.8.0-cert6"},{"introduced":"16.8.0-cert7"},{"last_affected":"16.8.0-cert7"},{"introduced":"16.8.0-cert8"},{"last_affected":"16.8.0-cert8"},{"introduced":"16.8.0-cert9"},{"last_affected":"16.8.0-cert9"}],"source":"CPE_STRING","vendor_product":"asterisk:certified_asterisk"},{"cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"},{"introduced":"10.0"},{"last_affected":"10.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html"},{"type":"ADVISORY","url":"http://packetstormsecurity.com/files/166225/Asterisk-Project-Security-Advisory-AST-2022-004.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202210-37"},{"type":"ADVISORY","url":"https://www.debian.org/security/2022/dsa-5285"},{"type":"FIX","url":"http://seclists.org/fulldisclosure/2022/Mar/0"},{"type":"FIX","url":"https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865"},{"type":"FIX","url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-2qpg-f6wf-w984"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asterisk/asterisk","events":[{"introduced":"0"},{"fixed":"d436f568583184a13aa46349af5a3f0907087b44"},{"introduced":"a65908f83e2f17a3aca7eb39c8e06045aca02674"},{"fixed":"c28961a7d88cf065f693d1ea412c3e2b35e6d18e"},{"introduced":"2c1bba3cbec008c8ce35c78a2c79f9f207ea58bc"},{"fixed":"4cf4f5f7076125bc649727540de5922c21e0558f"},{"introduced":"de4f63b4824c91a0cd9f3d95f3b7923bec71960c"},{"fixed":"7eb4edc725d6fa6877d88129d7bf99c0a1604de9"},{"introduced":"d436f568583184a13aa46349af5a3f0907087b44"},{"last_affected":"d436f568583184a13aa46349af5a3f0907087b44"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"16.8.0"},{"introduced":"16.0.0"},{"fixed":"16.24.1"},{"introduced":"18.0.0"},{"fixed":"18.10.1"},{"introduced":"19.0.0"},{"fixed":"19.2.1"},{"introduced":"16.8.0"},{"last_affected":"16.8.0"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:asterisk:certified_asterisk:*:*:*:*:*:*:*:*","cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:*:*:*:*:*:*:*"]}}],"versions":["16.8.0","19.2.0","18.10.0","16.24.0","19.2.0-rc1","18.10.0-rc1","16.24.0-rc1","16.8.0-rc2","16.8.0-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37706.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/pjsip/pjproject","events":[{"introduced":"0"},{"last_affected":"513700f74787009241a11eda125284277f7dfc1c"},{"fixed":"15663e3f37091069b8c98a7fce680dc04bc8e865"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2.11.1"}]}}],"versions":["2.11.1","2.11","2.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37706.json","vanir_signatures_modified":"2026-07-09T11:34:15Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["286375471227338908900759340395951320869","337170165584158815641361604078421931103","218425442522531084557250897674746904437","215575948014480304126719586812745130850"],"threshold":0.9},"id":"CVE-2021-37706-6c9a95f2","signature_type":"Line","signature_version":"v1","source":"https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865","target":{"file":"pjnath/src/pjnath/stun_msg.c"}},{"source":"https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865","target":{"file":"pjnath/src/pjnath/stun_msg.c","function":"decode_errcode_attr"},"deprecated":false,"digest":{"length":452,"function_hash":"166111760674862860056573304105766004106"},"id":"CVE-2021-37706-9e426c0f","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}