CyberRota Analysis
AI-GeneratedThe vulnerability exists in the webrtcbin component of GStreamer, where a logic flaw in the _check_sdp_crypto() function improperly handles SDP offers or answers regarding the a=fingerprint attribute. This could allow an attacker to intercept and modify WebRTC signaling messages, potentially bypassing DTLS certificate fingerprint binding and exposing media streams to man-in-the-middle attacks. Organizations utilizing GStreamer for WebRTC applications should prioritize addressing this vulnerability to enhance their security posture against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.