CVE-2021-28681

Name of the Vulnerable Software and Affected Versions: Pion WebRTC versions prior to 3.0.15

Description: The issue arises from improper teardown of the DTLS connection when certificate verification fails. As a result, data channel communication is incorrectly allowed with users who have failed DTLS certificate verification. This can occur when an attacker knows the ICE password and the attack takes place during the PeerConnection handshake. The issue can be detected by monitoring the PeerConnectionState in all versions of Pion WebRTC.

Recommendations: For versions prior to 3.0.15, users should upgrade to v3.0.15 to resolve the issue. As a temporary workaround, users should listen for when PeerConnectionState changes to PeerConnectionStateFailed and not continue using the PeerConnection when it enters this state.