PJSIP GnuTLS Build SIP TLS Transport Certificate Verification Vulnerability

A vulnerability exists in PJSIP versions prior to 2.17, specifically in GnuTLS builds, where the SIP TLS transport can accept connections with invalid or untrusted certificates. This occurs even when the application enables certificate verification. As a result, a network-positioned attacker could exploit this to intercept SIPS connections or bypass mutual-TLS authentication.

Impact

The vulnerability allows a network-positioned attacker to manipulate TLS connections. In client mode, it enables man-in-the-middle attacks by allowing untrusted, expired, or self-signed certificates to be accepted. In server mode, it bypasses mutual-TLS authentication by accepting any client certificate.

Remediation

Users can update to PJSIP version 2.17, where this vulnerability has been patched. The patch is available in the master branch.