Impact
Data channel communication was incorrectly allowed with users who have failed DTLS certificate verification.
This attack requires
- Attacker knows the ICE password.
- Only take place during PeerConnection handshake.
This attack can be detected by monitoring PeerConnectionState in all versions of Pion WebRTC.
Patches
Users should upgrade to v3.0.15.
The exact patch is pion/webrtc@545613d
Workarounds
Users should listen for when PeerConnectionState changes to PeerConnectionStateFailed. When it enters this state users should not continue using the PeerConnection.
For more information
If you have any questions or comments about this advisory:
Thank you to https://github.com/Gaukas for discovering this.
References
Impact
Data channel communication was incorrectly allowed with users who have failed DTLS certificate verification.
This attack requires
This attack can be detected by monitoring
PeerConnectionStatein all versions of Pion WebRTC.Patches
Users should upgrade to v3.0.15.
The exact patch is pion/webrtc@545613d
Workarounds
Users should listen for when
PeerConnectionStatechanges toPeerConnectionStateFailed. When it enters this state users should not continue using the PeerConnection.For more information
If you have any questions or comments about this advisory:
Thank you to https://github.com/Gaukas for discovering this.
References