Improper Input Validation Affecting github.com/pion/webrtc/v3 Open this link in a new tab package, versions <3.0.15
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-GOLANG-GITHUBCOMPIONWEBRTCV3-1086689
-
published
18 Mar 2021
-
disclosed
18 Mar 2021
-
credit
Unknown
Introduced: 18 Mar 2021
CVE-2021-28681 Open this link in a new tabHow to fix?
Upgrade github.com/pion/webrtc/v3
to version 3.0.15 or higher.
Overview
github.com/pion/webrtc/v3 is an A pure Go implementation of the WebRTC API
Affected versions of this package are vulnerable to Improper Input Validation. Pion WebRTC didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. A WebRTC implementation shouldn't allow the user to continue if verification has failed.)