Skip to content
OpenAdvisories
Medium · 5.3 CVE-2021-28681 EUVD-2021-0985GHSA-74xm-qj29-cq8pGO-2021-0104

In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication

Published Mar 18, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Description

Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/pion/webrtc/v3 < 3.0.15 3.0.15 GHSA-74xm-qj29-cq8p

References