CVE-2026-14935

תיאור (מקור, אנגלית)

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.

מדדים

CVSS 3.1

3.7 (LOW) מקור הציון: CNA CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-16/8/2026

CWE

CWE-670

קישורים

• https://access.redhat.com/security/cve/CVE-2026-14935
• https://bugzilla.redhat.com/show_bug.cgi?id=2497679
• https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/98
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5171