CVE-2021-28681
Medium
Description
Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)
SeverityMedium
CVSS5.3
Exploit probability—
Product
Webrtc
PublishedMar 18, 2021
First seenMar 18, 2021
How to fix
Update
- webrtc_project webrtc3.0.15 or later
- github.com/pion/webrtc/v33.0.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webrtc_project webrtc | v < 3.0.15 | 3.0.15 |
| github.com/pion/webrtc/v3Go | v < 3.0.15 | 3.0.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.