CVE-2021-28681

Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 28%
VendorProductVersion
webrtc_projectwebrtc
𝑥
< 3.0.15
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/pion/webrtc/issues/1708
https://github.com/pion/webrtc/security/advisories/GHSA-74xm-qj29-cq8p
https://github.com/pion/webrtc/issues/1708
https://github.com/pion/webrtc/security/advisories/GHSA-74xm-qj29-cq8p