CVE-2020-15260

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.10 and earlier, PJSIP transport can be reused if they have the same IP address + port + protocol. However, this is insufficient for secure transport since it lacks remote hostname authentication. Suppose we have created a TLS connection to `sip.foo.com`, which has an IP address `100.1.1.1`. If we want to create a TLS connection to another hostname, say `sip.bar.com`, which has the same IP address, then it will reuse that existing connection, even though `100.1.1.1` does not have certificate to authenticate as `sip.bar.com`. The vulnerability allows for an insecure interaction without user awareness. It affects users who need access to connections to different destinations that translate to the same address, and allows man-in-the-middle attack if attacker can route a connection to another destination such as in the case of DNS spoofing.

• CWE-297
• CWE-295

• https://github.com/pjsip/pjproject/commit/67e46c1ac45ad784db5b9080f5ed8b133c122872Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/pull/2663Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-8hcp-hm38-mfphPatch, Third Party Advisory
• https://security.gentoo.org/glsa/202107-42Third Party Advisory
• https://github.com/pjsip/pjproject/commit/67e46c1ac45ad784db5b9080f5ed8b133c122872Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/pull/2663Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-8hcp-hm38-mfphPatch, Third Party Advisory
• https://security.gentoo.org/glsa/202107-42Third Party Advisory

Published

Mar 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15255In Anuko Time Tracker before verion 1.19.23.5325, due to not…7.3
• CVE-2020-15256A prototype pollution vulnerability has been found in `objec…9.8
• CVE-2020-15257containerd is an industry-standard container runtime and is …5.2
• CVE-2020-15258In Wire before 3.20.x, `shell.openExternal` was used without…8
• CVE-2020-15259ad-ldap-connector's admin panel before version 5.0.13 does n…8.8
• CVE-2020-1526An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15261On Windows the Veyon Service before version 4.4.2 contains a…6.7
• CVE-2020-15262In webpack-subresource-integrity before version 1.5.1, all d…3.7
• CVE-2020-15263In platform before version 9.4.4, inline attributes are not …6.1
• CVE-2020-15264The Boxstarter installer before version 2.13.0 configures C:…7.8
• CVE-2020-15265In Tensorflow before version 2.4.0, an attacker can pass an …7.5
• CVE-2020-15266In Tensorflow before version 2.4.0, when the `boxes` argumen…7.5