CVE catalog

CVE-2021-32686

ring: CVE-2021-32686

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.07% · Oct 25, 2026

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianringbookworm20230206.0~ds2-1.1+deb12u1fixed
Debianringbookworm-security20230206.0~ds2-1.1+deb12u1fixed
Alpinepjproject3.142.11.1-r0fixed
Alpinepjproject3.152.11.1-r0fixed
Alpinepjproject3.162.11.1-r0fixed
Alpinepjproject3.172.11.1-r0fixed
Alpinepjproject3.182.11.1-r0fixed
Alpinepjproject3.192.11.1-r0fixed
Alpinepjproject3.202.11.1-r0fixed
Alpinepjproject3.212.11.1-r0fixed
Alpinepjproject3.222.11.1-r0fixed
Alpinepjproject3.232.11.1-r0fixed
Alpinepjproject3.242.11.1-r0fixed
Ubuntupjprojectpro2.6~dfsg-2vulnerable
Ubuntupjprojectpro2.7~dfsg-1vulnerable
Ubuntupjprojectpro2.7.1~dfsg-1vulnerable
Ubuntupjprojectpro2.7.1~dfsg-1build1vulnerable
Ubuntupjprojectpro2.7.2~dfsg-1vulnerable
Ubuntupjprojectpro2.7.2~dfsg-1ubuntu0.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianringsourcebookworm20230206.0~ds1-1not yet assignedNot reported[1014998]
Alpinepjprojectapk3.142.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Alpinepjprojectapk3.152.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Alpinepjprojectapk3.162.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Alpinepjprojectapk3.172.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Alpinepjprojectapk3.182.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Alpinepjprojectapk3.192.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Alpinepjprojectapk3.202.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Alpinepjprojectapk3.212.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Alpinepjprojectapk3.222.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Alpinepjprojectapk3.232.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Alpinepjprojectapk3.242.11.1-r0Not reportedALPINE-CVE-2021-32686Not reported
Ubuntupjprojectdebpro2.7.2~dfsg-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2021-32686Not reported

[Debian bug #1014998]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [jami]Fixed

    Source package: [ring]

    Details (4)

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

  • [jami-daemon]Fixed

    Source package: [ring]

    Details (4)

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm; dsa · ring · debian · 12

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]