vulnerability
Ubuntu: USN-6422-1 (CVE-2021-43804): Ring vulnerabilities
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | Dec 22, 2021 | Oct 10, 2023 | Apr 16, 2026 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Dec 22, 2021
Added
Oct 10, 2023
Modified
Apr 16, 2026
Description
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.
Solutions
ubuntu-pro-upgrade-ringubuntu-pro-upgrade-ring-daemonubuntu-upgrade-jamiubuntu-upgrade-jami-daemonubuntu-upgrade-ringubuntu-upgrade-ring-daemon
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.